實際使用shiro的時候大部分都是和spring等框架結合使用，主要就是配置web.xml將shiro的filter和spring容器bean的filter關聯起來，生命週期由servlet容器來控制，然後配置shiro的spring的xml檔案，其中主要配置shiro過濾器securityManager、認證成功失敗的跳轉頁面、過濾鏈、憑證匹配器（hash 還是 sha1等）、自定義的realm、快取管理器（ehcache、redis）、會話管理器等等

一般許可權表設計都是5張：

使用者表

角色表

許可權表

使用者角色表

角色許可權表

使用者表 -n:n- 角色表 中間表是 使用者角色表
角色表 -n:n- 許可權表 中間表示 角色許可權表

下面是demo工程的結構：

主要貼出下面幾個配置檔案：

springmvc.xml

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:p="http://www.springframework.org/schema/p"
       xmlns:context="http://www.springframework.org/schema/context"
 

       xmlns:mvc="http://www.springframework.org/schema/mvc"
       xmlns:aop="http://www.springframework.org/schema/aop" xmlns:tx="http://www.springframework.org/schema/tx"
       xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
        http://www.springframework.org/schema/mvc http://www.springframework.org/schema/mvc/spring-mvc-4.0.xsd
        http://www.springframework.org/schema/aop http://www.springframework.org/schema/aop/spring-aop-3.2.xsd
        http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd"
 
>

    <context:component-scan base-package="com.lijie.controller"/>
    <mvc:annotation-driven/>
    <!-- 開啟aop，對類代理 -->
    <aop:config proxy-target-class="true"></aop:config>
</beans>

applicationContext-shiro.xml

<beans xmlns="http://www.springframework.org/schema/beans"
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:mvc="http://www.springframework.org/schema/mvc"
       xmlns:context="http://www.springframework.org/schema/context"
       xmlns:aop="http://www.springframework.org/schema/aop" xmlns:tx="http://www.springframework.org/schema/tx"
       xsi:schemaLocation="http://www.springframework.org/schema/beans
        http://www.springframework.org/schema/beans/spring-beans-3.2.xsd 
        http://www.springframework.org/schema/mvc 
        http://www.springframework.org/schema/mvc/spring-mvc-3.2.xsd 
        http://www.springframework.org/schema/context 
        http://www.springframework.org/schema/context/spring-context-3.2.xsd 
        http://www.springframework.org/schema/aop 
        http://www.springframework.org/schema/aop/spring-aop-3.2.xsd 
        http://www.springframework.org/schema/tx 
        http://www.springframework.org/schema/tx/spring-tx-3.2.xsd ">

    <!-- web.xml中shiro的filter對應的bean -->
    <!-- Shiro 的Web過濾器 -->
    <bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
        <property name="securityManager" ref="securityManager"/>
        <!-- loginUrl認證提交地址，如果沒有認證將會請求此地址進行認證，請求此地址將由formAuthenticationFilter進行表單認證 -->
        <property name="loginUrl" value="/login"/>
        <!-- 認證成功統一跳轉到first.action，建議不配置，shiro認證成功自動到上一個請求路徑 -->
        <property name="successUrl" value="/success"/>
        <!-- 通過unauthorizedUrl指定沒有許可權操作時跳轉頁面-->
        <property name="unauthorizedUrl" value="/authorfail"/>
        <!-- 過慮器鏈定義，從上向下順序執行，一般將/**放在最下邊 -->
        <property name="filterChainDefinitions">
            <value>
                /logout = logout
                /** = authc
            </value>
        </property>
    </bean>

    <!-- securityManager安全管理器 -->
    <bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
        <property name="realm" ref="myRealm"/>
        <!-- 注入快取管理器 -->
        <property name="cacheManager" ref="cacheManager"/>
        <!-- 注入session管理器 -->
        <property name="sessionManager" ref="sessionManager"/>
    </bean>

    <!-- realm -->
    <bean id="myRealm" class="com.lijie.shiro.MyRealm">
        <!-- 將憑證匹配器設定到realm中，realm按照憑證匹配器的要求進行雜湊 -->
        <property name="credentialsMatcher" ref="credentialsMatcher"/>
    </bean>

    <!-- 憑證匹配器 -->
    <bean id="credentialsMatcher"
          class="org.apache.shiro.authc.credential.HashedCredentialsMatcher">
        <property name="hashAlgorithmName" value="md5"/>
        <property name="hashIterations" value="1"/>
    </bean>

    <!-- 快取管理器 -->
    <bean id="cacheManager" class="org.apache.shiro.cache.ehcache.EhCacheManager">
        <property name="cacheManagerConfigFile" value="classpath:spring/shiro-ehcache.xml"/>
    </bean>

    <!-- 會話管理器 -->
    <bean id="sessionManager" class="org.apache.shiro.web.session.mgt.DefaultWebSessionManager">
        <!-- session的失效時長，單位毫秒 -->
        <property name="globalSessionTimeout" value="600000"/>
        <!-- 刪除失效的session -->
        <property name="deleteInvalidSessions" value="true"/>
    </bean>

    <!-- 開啟shiro註解支援 -->
    <bean class="org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor">
        <property name="securityManager" ref="securityManager"/>
    </bean>

</beans>

其中上面的過濾鏈有很多種攔截：

anon
org.apache.shiro.web.filter.authc.AnonymousFilter
authc
org.apache.shiro.web.filter.authc.FormAuthenticationFilter
authcBasic
org.apache.shiro.web.filter.authc.BasicHttpAuthenticationFilter
perms
org.apache.shiro.web.filter.authz.PermissionsAuthorizationFilter
port
org.apache.shiro.web.filter.authz.PortFilter
rest
org.apache.shiro.web.filter.authz.HttpMethodPermissionFilter
roles
org.apache.shiro.web.filter.authz.RolesAuthorizationFilter
ssl
org.apache.shiro.web.filter.authz.SslFilter
user
org.apache.shiro.web.filter.authc.UserFilter
logout
org.apache.shiro.web.filter.authc.LogoutFilter

例子：
1.anon:  例子/lijie/**=anon 沒有引數，表示可以匿名使用。
2.authc: 例如/lijie/user/**=authc表示需要認證(登入)才能使用，FormAuthenticationFilter是表單認證，沒有引數 
3.perms：例子/lijie/user/**=perms[test:add:*],引數可以寫多個，多個時必須加上引號，並且引數之間用逗號分割，例如/admins/user/**=perms["test:add:*,test:delete:*"]，當有多個引數時必須每個引數都通過才通過，想當於isPermitedAll()方法。
4.user:  例子/lijie/user/**=user沒有引數表示必須存在使用者, 身份認證通過或通過記住我認證通過的可以訪問，當登入操作時不做檢查

applicationContext-service.xml

<beans xmlns="http://www.springframework.org/schema/beans"
       xmlns:context="http://www.springframework.org/schema/context" xmlns:p="http://www.springframework.org/schema/p"
       xmlns:aop="http://www.springframework.org/schema/aop" xmlns:tx="http://www.springframework.org/schema/tx"
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
       xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-4.0.xsd
    http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-4.0.xsd
    http://www.springframework.org/schema/aop http://www.springframework.org/schema/aop/spring-aop-4.0.xsd http://www.springframework.org/schema/tx http://www.springframework.org/schema/tx/spring-tx-4.0.xsd
    http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util-4.0.xsd">

    <!-- 掃描包 -->
    <context:component-scan base-package="com.lijie.service,com.lijie.shiro"></context:component-scan>
</beans>

applicationContext-dao.xml

<beans xmlns="http://www.springframework.org/schema/beans"
    xmlns:context="http://www.springframework.org/schema/context" xmlns:p="http://www.springframework.org/schema/p"
    xmlns:aop="http://www.springframework.org/schema/aop" xmlns:tx="http://www.springframework.org/schema/tx"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-4.0.xsd
    http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-4.0.xsd
    http://www.springframework.org/schema/aop http://www.springframework.org/schema/aop/spring-aop-4.0.xsd http://www.springframework.org/schema/tx http://www.springframework.org/schema/tx/spring-tx-4.0.xsd
    http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util-4.0.xsd">

    <!-- 資料庫連線池 -->
    <!-- 載入配置檔案 -->
    <context:property-placeholder location="classpath:resource/*.properties" />
    <!-- 資料庫連線池 -->
    <bean id="dataSource" class="com.alibaba.druid.pool.DruidDataSource"
        destroy-method="close">
        <property name="url" value="${jdbc.url}" />
        <property name="username" value="${jdbc.username}" />
        <property name="password" value="${jdbc.password}" />
        <property name="driverClassName" value="${jdbc.driver}" />
        <property name="maxActive" value="10" />
        <property name="minIdle" value="5" />
    </bean>
    <!-- 讓spring管理sqlsessionfactory 使用mybatis和spring整合包中的 -->
    <bean id="sqlSessionFactory" class="org.mybatis.spring.SqlSessionFactoryBean">
        <!-- 資料庫連線池 -->
        <property name="dataSource" ref="dataSource" />
        <!-- 改變mybatis 的xml 的位置 -->
        <property name="mapperLocations" value="classpath:mapper/*.xml"/>
        <!-- 載入mybatis的全域性配置檔案 -->
        <property name="configLocation" value="classpath:mybatis/SqlMapConfig.xml" />
    </bean>
    <bean class="org.mybatis.spring.mapper.MapperScannerConfigurer">
        <property name="basePackage" value="com.lijie.mapper" />
    </bean>
</beans>

applicationContext-trans.xml 切面事務配置

<beans xmlns="http://www.springframework.org/schema/beans"
    xmlns:context="http://www.springframework.org/schema/context" xmlns:p="http://www.springframework.org/schema/p"
    xmlns:aop="http://www.springframework.org/schema/aop" xmlns:tx="http://www.springframework.org/schema/tx"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-4.0.xsd
    http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-4.0.xsd
    http://www.springframework.org/schema/aop http://www.springframework.org/schema/aop/spring-aop-4.0.xsd http://www.springframework.org/schema/tx http://www.springframework.org/schema/tx/spring-tx-4.0.xsd
    http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util-4.0.xsd">
    <!-- 事務管理器 -->
    <bean id="transactionManager"
        class="org.springframework.jdbc.datasource.DataSourceTransactionManager">
        <!-- 資料來源 -->
        <property name="dataSource" ref="dataSource" />
    </bean>
    <!-- 通知 -->
    <tx:advice id="txAdvice" transaction-manager="transactionManager">
        <tx:attributes>
            <!-- 傳播行為 -->
            <tx:method name="save*" propagation="REQUIRED" />
            <tx:method name="insert*" propagation="REQUIRED" />
            <tx:method name="add*" propagation="REQUIRED" />
            <tx:method name="create*" propagation="REQUIRED" />
            <tx:method name="delete*" propagation="REQUIRED" />
            <tx:method name="update*" propagation="REQUIRED" />
            <tx:method name="find*" propagation="SUPPORTS" read-only="true" />
            <tx:method name="select*" propagation="SUPPORTS" read-only="true" />
            <tx:method name="get*" propagation="SUPPORTS" read-only="true" />
        </tx:attributes>
    </tx:advice>
    <!-- 切面 -->
    <aop:config>
        <aop:advisor advice-ref="txAdvice"
            pointcut="execution(* com.lijie.service.*.*(..))" />
    </aop:config>
</beans>

shiro-ehcache.xml 快取配置

<ehcache>
    <!--diskStore：快取資料持久化的目錄 地址  -->
    <diskStore path="./ehcache" />
    <defaultCache 
        maxElementsInMemory="1000" 
        maxElementsOnDisk="10000000"
        eternal="false" 
        overflowToDisk="false" 
        diskPersistent="false"
        timeToIdleSeconds="120"
        timeToLiveSeconds="120" 
        diskExpiryThreadIntervalSeconds="120"
        memoryStoreEvictionPolicy="LRU">
    </defaultCache>
</ehcache>

SqlMapConfig.xml mybatis的外掛配置

<?xml version="1.0" encoding="UTF-8" ?>
<!DOCTYPE configuration
        PUBLIC "-//mybatis.org//DTD Config 3.0//EN"
        "http://mybatis.org/dtd/mybatis-3-config.dtd">
<configuration>
    <!-- 配置分頁外掛 -->
    <plugins>
        <plugin interceptor="com.github.pagehelper.PageHelper">
            <!-- 配置資料庫方言 -->
            <property name="dialect" value="mysql"/>
        </plugin>
    </plugins>
</configuration>

web.xml

<?xml version="1.0" encoding="utf-8"?>
<web-app xmlns="http://java.sun.com/xml/ns/javaee"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://java.sun.com/xml/ns/javaee
                      http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd"
         version="3.0">
    <display-name>myshiro</display-name>

    <!-- 載入spring容器 -->
    <context-param>
        <param-name>contextConfigLocation</param-name>
        <param-value>classpath:spring/applicationContext-*.xml</param-value>
    </context-param>
    <listener>
        <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
    </listener>

    <!-- 解決post亂碼 -->
    <filter>
        <filter-name>CharacterEncodingFilter</filter-name>
        <filter-class>org.springframework.web.filter.CharacterEncodingFilter</filter-class>
        <init-param>
            <param-name>encoding</param-name>
            <param-value>utf-8</param-value>
        </init-param>
    </filter>
    <filter-mapping>
        <filter-name>CharacterEncodingFilter</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>

    <!-- springmvc的前端控制器 -->
    <servlet>
        <servlet-name>web-demo</servlet-name>
        <servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
        <init-param>
            <param-name>contextConfigLocation</param-name>
            <param-value>classpath:spring/springmvc.xml</param-value>
        </init-param>
        <load-on-startup>1</load-on-startup>
    </servlet>
    <servlet-mapping>
        <servlet-name>web-demo</servlet-name>
        <!-- 攔截所有請求，包括靜態資源。需要springmv.xml 中新增靜態資源 -->
        <url-pattern>/</url-pattern>
    </servlet-mapping>

    <!-- shiro過慮器，DelegatingFilterProxy通過代理模式將spring容器中的bean和filter關聯起來 -->
    <filter>
        <filter-name>shiroFilter</filter-name>
        <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
        <!-- 設定true由servlet容器控制filter的生命週期 -->
        <init-param>
            <param-name>targetFilterLifecycle</param-name>
            <param-value>true</param-value>
        </init-param>
        <!-- 設定spring容器filter的bean id，如果不設定則找與filter-name一致的bean-->
        <init-param>
            <param-name>targetBeanName</param-name>
            <param-value>shiroFilter</param-value>
        </init-param>
    </filter>
    <filter-mapping>
        <filter-name>shiroFilter</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>
</web-app>

自定義的Realm MyRealm

public class MyRealm extends AuthorizingRealm {

    protected static final Logger logger = LoggerFactory.getLogger(MyRealm.class);

    @Autowired
    private SysService sysService;

    /**
     * 認證
     *
     * @param authenticationToken
     * @return
     * @throws AuthenticationException
     */
    @Override
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken) throws AuthenticationException {

        // 獲取憑證賬號
        String username = (String) authenticationToken.getPrincipal();

        logger.info("AuthenticationInfo 開始認證-》:{}", username);

        SysUser sysUserByUserCode = null;
        List<SysPermission> permissionListByUserId = null;
        try {
            //通過賬號查詢使用者資訊
            sysUserByUserCode = sysService.findSysUserByUserCode(username);

            //通過賬號查詢使用者選單
            permissionListByUserId = sysService.findMenuListByUserId(username);
        } catch (Exception e) {
            e.printStackTrace();
        }

        // 賬號為空返回null
        if (null == sysUserByUserCode) {
            return null;
        }

        // 相當於session裡面儲存的
        ActiveUser user = new ActiveUser();
        user.setUserid(sysUserByUserCode.getId());
        user.setUsercode(sysUserByUserCode.getUsercode());
        user.setUsername(sysUserByUserCode.getUsername());
        user.setMenus(permissionListByUserId);

        // 組裝的info
        SimpleAuthenticationInfo simpleAuthenticationInfo = new SimpleAuthenticationInfo(
                user, sysUserByUserCode.getPassword(), ByteSource.Util.bytes(sysUserByUserCode.getSalt()), this.getClass().getName());

        return simpleAuthenticationInfo;
    }

    /**
     * 授權
     *
     * @param principalCollection
     * @return
     */
    @Override
    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {

        // 取出身份資訊
        ActiveUser user = (ActiveUser) principalCollection.getPrimaryPrincipal();

        logger.info("AuthorizationInfo 開始授權-》:{}", user.getUserid());

        List<SysPermission> permissionListByUserId = null;

        // 查詢具體許可權
        try {
            permissionListByUserId = sysService.findPermissionListByUserId(user.getUserid());
        } catch (Exception e) {
            e.printStackTrace();
        }

        List<String> permissions = null;

        if (!CollectionUtils.isEmpty(permissionListByUserId)) {
            permissions = new ArrayList<>();
            for (SysPermission perm : permissionListByUserId) {
                permissions.add(perm.getPercode());
            }
        }

        //查到許可權資料，返回授權資訊(要包括 上邊的permissions)
        SimpleAuthorizationInfo simpleAuthorizationInfo = new SimpleAuthorizationInfo();
        //將上邊查詢到授權資訊填充到simpleAuthorizationInfo物件中
        simpleAuthorizationInfo.addStringPermissions(permissions);

        return simpleAuthorizationInfo;
    }

    //清除快取
    public void clearCached() {
        PrincipalCollection principals = SecurityUtils.getSubject().getPrincipals();
        super.clearCache(principals);
    }
}

以及一個測試的controller：

@Controller
public class TestController {

    protected static final Logger logger = LoggerFactory.getLogger(TestController.class);

    @Autowired
    private TestService testService;
    @Autowired
    private SysService sysService;

    @RequestMapping("/user/{name}/desc/{desc}")
    @RequiresPermissions(value = {"test:query", "test:xxx"}, logical = Logical.OR)
    @ResponseBody
    public Response getResponse(@PathVariable String name, @PathVariable String desc) {
        return Response.success(testService.getTestVo(name, desc));
    }

    @RequestMapping("/login")
    @ResponseBody
    public Response login(HttpServletRequest request) {

        Subject subject = SecurityUtils.getSubject();

        //如果登陸失敗從request中獲取認證異常資訊，shiroLoginFailure就是shiro異常類的全限定名
        String exceptionClassName = (String) request.getAttribute("shiroLoginFailure");
        String url = request.getRequestURI();
        //根據shiro返回的異常類路徑判斷，丟擲指定異常資訊
        if (exceptionClassName != null) {
            if (UnknownAccountException.class.getName().equals(exceptionClassName)) {
                return Response.authenfail();
            } else if (IncorrectCredentialsException.class.getName().equals(
                    exceptionClassName)) {
                return Response.authenfail();
            } else {
                return Response.authenfail();
            }
        }

        if (subject.isAuthenticated()) {
            return Response.success("已經登入");
        } else {
            return Response.success("請先登入");
        }

    }

    @RequestMapping("/authenfail")
    @ResponseBody
    public Response authenfail() {
        return Response.authenfail();
    }

    @RequestMapping("/authorfail")
    @ResponseBody
    public Response authorfail() {
        return Response.authorfail();
    }

    @RequestMapping("/success")
    @ResponseBody
    public Response success() {
        return Response.success("登入成功");
    }
}

因為沒有頁面，所以全都是ResponseBody，可以使用postman測試，啟動程式，然後先進行登入操作：

然後再進行getResponse這個controller的訪問：