摘要：配置配置核心控制器過濾器配置同時(shí)在中配置匿名的不需要權(quán)限需要認(rèn)證通過即登錄成功需要名稱為的權(quán)限需要名稱為的角色說明匹配的的是匹配的是多個(gè)比如

      
      
        org.apache.shiro  
        shiro-web  
        ${shiro-version}  
      
      
      
        org.apache.shiro  
        shiro-spring  
        ${shiro-version}  
      
      
      
        org.apache.shiro  
        shiro-ehcache  
        ${shiro-version}  
      
    ...
    
        1.2.4
    

    
 
  

  

      
  

  
  
      
      
    
    
    
        
      
      
          
            /logout.do        = anon    
            /image/*.do        = authc    
            /blog/**.do        = authc,perms[blog] 
            /admin/*.do        = authc,roles[admin] 
            
          
      
  

  
    shiroFilter  
    org.springframework.web.filter.DelegatingFilterProxy  
      
        targetFilterLifecycle  
        true  
      
  
  
    shiroFilter  
    *.do  
    



    sitemesh
    org.sitemesh.config.ConfigurableSiteMeshFilter


    sitemesh
    *.do



    springmvc
    org.springframework.web.servlet.DispatcherServlet
    
        contextConfigLocation
        classpath:app-servlet.xml
        
    
    1



    springmvc
    *.do

PS : shiro filter，放在mvc的filter/servlet前面，如果有sitemesh，放在sitemesh前面

/**
 * 登錄和檢查授權(quán)的時(shí)候調(diào)用當(dāng)前類
 */
@Component("DefaultRealm")
public class DefaultRealm extends AuthorizingRealm {

  @Resource
  private AdminDao adminDao;

  public DefaultRealm() {
    setName("DefaultRealm");// This name must match the name in the User  
  }

  //獲取授權(quán)信息, 用于驗(yàn)證權(quán)限
  @Override
  protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {
    String username = (String) principalCollection.getPrimaryPrincipal();
    AdminUser admin = adminDao.getUniqueByProperty("username", username);
    Set roleSet = admin.getRoles();
    if (roleSet != null) {
      //獲取角色權(quán)限
      Set roles = new HashSet<>();
      Set stringPermissions = new HashSet<>();
      for (Role role : roleSet) {
        roles.add(role.getRoleName());

        //封裝到驗(yàn)證信息
        Set permissions = role.getPermissions();
        for (Permission permission : permissions) {
          stringPermissions.add(permission.getPermissionName());
        }
      }
      
      SimpleAuthorizationInfo authorizationInfo = new SimpleAuthorizationInfo();  
      authorizationInfo.setRoles(roles);  
      authorizationInfo.setStringPermissions(stringPermissions);  
      return authorizationInfo;
    }
    return null;
  }

  //獲取驗(yàn)證信息,用于登錄驗(yàn)證用戶名密碼
  @Override
  protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken principals)
      throws AuthenticationException {
    String username = (String) principals.getPrincipal();
    if (StringUtils.isNotEmpty(username)) {
      AdminUser admin = adminDao.getUniqueByProperty("username", username);
      SimpleAccount account = new SimpleAccount(username, admin.getPassword(), getName());
      return account;
    }
    return null;
  }

}

//在MVC的Controller中, 接收參數(shù)username和password, 裝配成UsernamePasswordToken對象,
//然后用subject對象login方法進(jìn)行登錄.
UsernamePasswordToken token = new UsernamePasswordToken(username, password);
Subject subject = SecurityUtils.getSubject();
subject.login(token);

@Entity
public class User {
    private String username; 
    private String password="";
    //省略getter setter
    
    private Set roles;
    
    @ManyToMany(targetEntity=Role.class)
    public Set getRoles() {
      return roles;
    }

    public void setRoles(Set roles) {
      this.roles = roles;
    }
}

@Entity
public class Role{
  private String roleName;    //省略getter setter
  private Set permissions = new HashSet<>();
  
  @ManyToMany
  public Set getPermissions() {
    return permissions;
  }

  public void setPermissions(Set permissions) {
    this.permissions = permissions;
  }
}  

@Entity
public class Permission {
    private String permissionName;//省略getter setter
}