[main]
#自定义authorizer
authorizer=org.apache.shiro.authz.ModularRealmAuthorizer
#自定义permissionResolver
#permissionResolver=org.apache.shiro.authz.permission.WildcardPermissionResolver
permissionResolver=servlet.BitAndWildPermissionResolver
authorizer.permissionResolver=$permissionResolver
#自定义rolePermissionResolver
rolePermissionResolver=servlet.MyRolePermissionResolver
authorizer.rolePermissionResolver=$rolePermissionResolver  securityManager.authorizer=$authorizer #自定义realm 一定要放在securityManager.authorizer赋值之后（因为调用setRealms会将realms设置给authorizer，并给各个Realm设置permissionResolver和rolePermissionResolver）
realm=realms.MyRealm1
securityManager.realms=$realm   

package servlet;import org.apache.shiro.authz.Permission;/*** BitPermission用于实现位移方式的权限，如规则是：* * 权限字符串格式：+资源字符串+权限位+实例ID；以+开头中间通过+分割；权限：0 表示所有权限；1 新增（二进制：0001）、2* 修改（二进制：0010）、4 删除（二进制：0100）、8 查看（二进制：1000）；如 +user+10 表示对资源user拥有修改/查看权限。* * @author Administrator**/
public class BitPermission implements Permission {private String resourceIdentify;private int permissionBit;private String instanceId;public BitPermission(String permissionString) {String[] array = permissionString.split("\\+");if (array.length > 1) {resourceIdentify = array[1];}if (resourceIdentify == null || resourceIdentify.equals("")) {resourceIdentify = "*";}if (array.length > 2) {permissionBit = Integer.valueOf(array[2]);}if (array.length > 3) {instanceId = array[3];}if (instanceId == null || resourceIdentify.equals("")) {instanceId = "*";}}public boolean implies(Permission p) {if (!(p instanceof BitPermission)) {return false;}BitPermission other = (BitPermission) p;if (!("*".equals(this.resourceIdentify) || this.resourceIdentify.equals(other.resourceIdentify))) {return false;}if (!(this.permissionBit == 0 || (this.permissionBit & other.permissionBit) != 0)) {return false;}if (!("*".equals(this.instanceId) || this.instanceId.equals(other.instanceId))) {return false;}return true;}
}

public class MyRealm1 extends AuthorizingRealm{/*** 判断授权的*/@Overrideprotected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {  SimpleAuthorizationInfo authorizationInfo = new SimpleAuthorizationInfo();  authorizationInfo.addRole("role1");  authorizationInfo.addRole("role2");  authorizationInfo.addObjectPermission(new BitPermission("+user1+10"));  authorizationInfo.addObjectPermission(new WildcardPermission("user1:*"));  authorizationInfo.addStringPermission("+user2+10");  authorizationInfo.addStringPermission("user2:*");  return authorizationInfo;  }  /*** 判断认证的*/@Overrideprotected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {String userName=token.getPrincipal().toString();String passWord=new String((char[])token.getCredentials());if(!userName.equals("zhang")) throw new UnknownAccountException("Realm1 用户名错误");if(!passWord.equals("123")) throw new IncorrectCredentialsException("Realm1 密码错误");return new SimpleAccount(userName, passWord, getName());}}

public class TestMain {public static void main(String[] args) {SecurityManager securityManager=new IniSecurityManagerFactory("classpath:shiro.ini").getInstance(); SecurityUtils.setSecurityManager(securityManager);Subject subject=SecurityUtils.getSubject();subject.login(new UsernamePasswordToken("zhang", "123"));//通过二进制位的方式表示权限  System.out.println(subject.isPermitted("+user1+2"));//新增权限  System.out.println(subject.isPermitted("+user1+8"));//查看权限System.out.println(subject.isPermitted("+user2+10"));//新增及查看
  System.out.println(subject.isPermitted("+user1+4"));//没有删除权限  System.out.println(subject.isPermitted("menu:view"));//通过MyRolePermissionResolver解析得到的权限
    }
}