<!-- https://mvnrepository.com/artifact/org.apache.shiro/shiro-web -->
<dependency><groupId>org.apache.shiro</groupId><artifactId>shiro-spring</artifactId><version>1.4.0</version>
</dependency>

@Bean
public ShiroFilterFactoryBean shiroFilterFactoryBean(SecurityManager securityManager) {ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();shiroFilterFactoryBean.setSecurityManager(securityManager);// 登录页面，无权限时跳转的路径shiroFilterFactoryBean.setLoginUrl("/login");// 配置拦截规则Map<String, String> filterMap = new HashMap<>();// 首页配置放行filterMap.put("/", "anon");// 登录页面和登录请求路径需要放行filterMap.put("/login", "anon");filterMap.put("/do_login", "anon");// 其他未配置的所有路径都需要通过验证，否则跳转到登录页filterMap.put("/**", "authc");shiroFilterFactoryBean.setFilterChainDefinitionMap(filterMap);return shiroFilterFactoryBean;
}

* authc：配置的url都必须认证通过才可以访问，它是Shiro内置的一个过滤器
* 对应的实现类 @see org.apache.shiro.web.filter.authc.FormAuthenticationFilter* anon：也是Shiro内置的，它对应的过滤器里面是空的，什么都没做，可以理解为不拦截
* 对应的实现类 @see org.apache.shiro.web.filter.authc.AnonymousFilter

public class UserAuthorizingRealm extends AuthorizingRealm {@Autowiredprivate LoginService loginService;/*** 授权验证，获取授权信息*/@Overrideprotected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {User user = (User) principalCollection.getPrimaryPrincipal();List<String> perms;// 系统管理员拥有最高权限if (User.SUPER_ADMIN == user.getId()) {perms = loginService.getAllPerms();} else {perms = loginService.getUserPerms(user.getId());}// 权限Set集合Set<String> permsSet = new HashSet<>();for (String perm : perms) {permsSet.addAll(Arrays.asList(perm.trim().split(",")));}// 返回权限SimpleAuthorizationInfo info = new SimpleAuthorizationInfo();info.setStringPermissions(permsSet);return info;}/*** 登录验证，获取身份信息*/@Overrideprotected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken) throws AuthenticationException {UsernamePasswordToken token = (UsernamePasswordToken) authenticationToken;// 获取用户User user = loginService.getUserByUsername(token.getUsername());if (user == null) {throw new UnknownAccountException("账号或密码不正确");}// 判断用户是否被锁定if (user.getStatus() == null || user.getStatus() == 1) {throw new LockedAccountException("账号已被锁定,请联系管理员");}// 验证密码if (!user.getPassword().equals(new String(token.getPassword()))) {throw new UnknownAccountException("账号或密码不正确");}user.setSessionId(SecurityUtils.getSubject().getSession().getId().toString());// 设置最后登录时间user.setLastLoginTime(new Date());// 此处可以持久化用户的登录信息，这里仅做演示没有连接数据库return new SimpleAuthenticationInfo(user, user.getPassword(), getName());}
}

@Bean
public DefaultAdvisorAutoProxyCreator defaultAdvisorAutoProxyCreator() {DefaultAdvisorAutoProxyCreator autoProxyCreator = new DefaultAdvisorAutoProxyCreator();autoProxyCreator.setProxyTargetClass(true);return autoProxyCreator;
}

@Bean
public AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor(SecurityManager securityManager) {AuthorizationAttributeSourceAdvisor advisor = new AuthorizationAttributeSourceAdvisor();advisor.setSecurityManager(securityManager);return advisor;
}

@RequestMapping("getLoginUserInfo")
@RequiresPermissions(value = {"user:list", "user:info"}, logical = Logical.OR)
public JsonResult getLoginUserInfo() {Subject subject = SecurityUtils.getSubject();User user = (User) subject.getPrincipal();return JsonResult.ok(user);
}