<!--Shiro核心框架 -->
        <dependency>
            <groupId>org.apache.shiro</groupId>
            <artifactId>shiro-core</artifactId>
            <version>${shiro.version}</version>
        </dependency>
        <!-- Shiro使用Spring框架 -->
        <dependency>
            <groupId>org.apache.shiro</groupId>
            <artifactId>shiro-spring</artifactId>
            <version>${shiro.version}</version>
        </dependency>
        <!-- Shiro使用EhCache緩存框架 -->
        <dependency>
            <groupId>org.apache.shiro</groupId>
            <artifactId>shiro-ehcache</artifactId>
            <version>${shiro.version}</version>
        </dependency>
        <!-- thymeleaf模板引擎和shiro框架的整合 -->
        <dependency>
            <groupId>com.github.theborakompanioni</groupId>
            <artifactId>thymeleaf-extras-shiro</artifactId>
            <version>${thymeleaf.extras.shiro.version}</version>
        </dependency>

 @Bean
    public ShiroFilterFactoryBean shiroFilterFactoryBean(DefaultWebSecurityManager securityManager)
    {
        ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();
        // Shiro的核心安全接口,這個(gè)屬性是必須的
        shiroFilterFactoryBean.setSecurityManager(securityManager);
        // 身份認(rèn)證失敗，則跳轉(zhuǎn)到登錄頁(yè)面的配置
        shiroFilterFactoryBean.setLoginUrl("/static/login.html");
        // 權(quán)限認(rèn)證失敗，則跳轉(zhuǎn)到指定頁(yè)面
        shiroFilterFactoryBean.setUnauthorizedUrl("/nopermissioin");
        // Shiro連接約束配置，即過(guò)濾鏈的定義
        LinkedHashMap<String, String> filterChainDefinitionMap = new LinkedHashMap<>();
        // 對(duì)靜態(tài)資源設(shè)置匿名訪(fǎng)問(wèn)
        // 不需要攔截的訪(fǎng)問(wèn)
        filterChainDefinitionMap.put("/login", "anon");
        filterChainDefinitionMap.put("/favicon.ico**", "anon");
        filterChainDefinitionMap.put("/static/**", "anon");
?
        // 退出 logout地址，shiro去清除session
        filterChainDefinitionMap.put("/logout", "logout");
        // 所有請(qǐng)求需要認(rèn)證
        filterChainDefinitionMap.put("/**", "authc");
        shiroFilterFactoryBean.setFilterChainDefinitionMap(filterChainDefinitionMap);
        return shiroFilterFactoryBean;
    }

   Subject subject= SecurityUtils.getSubject();
        UsernamePasswordToken token= new UsernamePasswordToken(username, password);
        subject.login(token);

     /**
     * 開(kāi)啟Shiro注解通知器
     */
    @Bean
    public AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor(
            DefaultWebSecurityManager securityManager)
    {
        AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor = new AuthorizationAttributeSourceAdvisor();
        authorizationAttributeSourceAdvisor.setSecurityManager(securityManager);
        return authorizationAttributeSourceAdvisor;
    }
    /**
     * 設(shè)置支持CGlib代理
     * 詳情看DefaultAopProxyFactory#createAopProxy
     * @return
     */
    @Bean
    public DefaultAdvisorAutoProxyCreator advisorAutoProxyCreator() {
        DefaultAdvisorAutoProxyCreator advisorAutoProxyCreator = new DefaultAdvisorAutoProxyCreator();
        advisorAutoProxyCreator.setProxyTargetClass(true);
        return advisorAutoProxyCreator;
    }

//授權(quán)相關(guān)
@Override
protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {
    Employee employee = (Employee)principals.getPrimaryPrincipal();
    SimpleAuthorizationInfo info = new SimpleAuthorizationInfo();
    //根據(jù)用戶(hù)的id查詢(xún)?cè)撚脩?hù)擁有的角色編碼
    List<Role> roles = roleService.queryByEmployeeId(employee.getId());
    for(Role role:roles){
        info.addRole(role.getSn());
    }
    //根據(jù)用戶(hù)的id查詢(xún)?cè)撚脩?hù)擁有的權(quán)限表達(dá)式
    List<String> permissions = permissionService.queryByEmployeeId(employee.getId());
    info.addStringPermissions(permissions);
    return info;
}

@ControllerAdvice
public class CommonControllerAdvice {
    @ExceptionHandler(AuthorizationException.class)
    public String exceptionHandler(AuthorizationException e){
        e.printStackTrace();
        return "/nopermission";
    }
}

        
        @Override
        protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection){
        Employee employee = (Employee) principalCollection.getPrimaryPrincipal();
        SimpleAuthorizationInfo info = new SimpleAuthorizationInfo();
        if (employee.isAdmin()) {//是管理員--權(quán)限可以使用通配符
            info.addStringPermission("*:*");
            //角色--不能使用通配符
            List<Role> roles = roleService.selAll();
            for (Role role : roles) {
                info.addRole(role.getSn());
            }else{
                 //余下邏輯與普通鑒權(quán)相同
            }
           return info;
        }

/**
 * thymeleaf模板引擎和shiro框架的整合
 */
@Bean
public ShiroDialect shiroDialect()
{
    return new ShiroDialect();
}

<html lang="zh" xmlns:th="http://www.thymeleaf.org" xmlns:shiro="http://www.pollix.at/thymeleaf/shiro">

<a href="#" rel="external nofollow"  class="btn btn-success btn-input" style="margin: 10px" shiro:hasPermission="department:saveOrUpdate">
    <span class="glyphicon glyphicon-plus"></span> 添加
</a>

<?xml version="1.0" encoding="UTF-8"?>
<ehcache>
    <defaultCache
            maxElementsInMemory="1000"
            eternal="false"
            timeToIdleSeconds="600"
            timeToLiveSeconds="600"
            memoryStoreEvictionPolicy="LRU">
    </defaultCache>
</ehcache>

@Bean
public EhCacheManager getEhCacheManager()
{
    EhCacheManager em = new EhCacheManager();
    em.setCacheManagerConfigFile("classpath:ehcache/ehcache-shiro.xml");
    return em;

}
/**
 * 自定義Realm
 */
@Bean
public EmployeeRealm userRealm(EhCacheManager cacheManager)
{
    EmployeeRealm employeeRealm = new EmployeeRealm();
    employeeRealm.setCacheManager(cacheManager);
    return employeeRealm;
}

@Bean
	//傳遞的參數(shù)名要與自定義realm的bean名一致-userRealm
    public DefaultWebSecurityManager securityManager(EmployeeRealm userRealm,DefaultWebSessionManager sessionManager){
        DefaultWebSecurityManager securityManager=new DefaultWebSecurityManager();
        //添加realm對(duì)象
        securityManager.setRealm(userRealm);
        //添加session管理器對(duì)象
        securityManager.setSessionManager(sessionManager);
        return securityManager;
    }

/**
*	在返回值中添加第三個(gè)參數(shù) ByteSource.Util.bytes(employee.getSalt())
*/
@Override
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken) throws AuthenticationException {
        String username = (String) authenticationToken.getPrincipal();
        Employee employee = employeeService.selUserByUsername(username);
        if (employee == null) {
            return null;
        }
        return new SimpleAuthenticationInfo(employee, employee.getPassword(),
                ByteSource.Util.bytes(employee.getSalt()), getName());
    }

	@Bean
    public HashedCredentialsMatcher hashedCredentialsMatcher(){
        HashedCredentialsMatcher matcher=new HashedCredentialsMatcher("md5");
        matcher.setHashIterations(3);
        return matcher;
    }

	@Bean
    public EmployeeRealm userRealm(EhCacheManager cacheManager,
                                   HashedCredentialsMatcher hashedCredentialsMatcher)
    {
        EmployeeRealm employeeRealm = new EmployeeRealm();
        employeeRealm.setCacheManager(cacheManager);
        //這里
        employeeRealm.setCredentialsMatcher(hashedCredentialsMatcher);
        return employeeRealm;
    }

//添加用戶(hù)的service方法
	@Override
    public void add(Employee employee, Long[] roleIds) {
    	//生成隨機(jī)鹽
        String salt = UUID.randomUUID().toString().substring(0, 4);
        //生成加密的密碼
        Md5Hash pwd=new Md5Hash(employee.getPassword(), salt,3);
        //將鹽和密碼都設(shè)置給對(duì)象
        employee.setPassword(pwd.toString());
        employee.setSalt(salt);
        //最后進(jìn)行添加
        employeeMapper.insert(employee);
        
        //向關(guān)聯(lián)表批量插入
        if (roleIds != null && roleIds.length > 0 && !employee.isAdmin())//合理化校驗(yàn)
        {
            employeeMapper.insertRelationBatch(employee.getId(), roleIds);
        }
    }

/**
 * session管理器
 */
@Bean
public DefaultWebSessionManager sessionManager() {
    DefaultWebSessionManager sessionManager = new DefaultWebSessionManager();
    sessionManager.setSessionIdUrlRewritingEnabled(false);
    return sessionManager;
}

	//安全管理器對(duì)象
    @Bean
    public DefaultWebSecurityManager securityManager(EmployeeRealm userRealm,DefaultWebSessionManager sessionManager){
        DefaultWebSecurityManager securityManager=new DefaultWebSecurityManager();
        //添加realm對(duì)象
        securityManager.setRealm(userRealm);
        //添加session管理器對(duì)象
        securityManager.setSessionManager(sessionManager);
        return securityManager;
    }