/**
 * 用戶
 */
public class User {
 private Integer id;
 private String username;
 private String password;
 //getter & setter...
}

/**
 * 角色
 */
public class Role {
 private String id;
 private String rolename;
}

/**
 * 資源
 */
public class Resource {
 private String id;
 private String resname;
}

/**
 * 角色-資源
 */
public class RoleRes {
 private String id;
 private String roleid;
 private String resid;
}

/**
 * 用戶-角色
 */
public class UserRole {
 private String id;
 private String userid;
 private String roleid;
}

<dependency>
 <groupId>org.apache.shiro</groupId>
 <artifactId>shiro-core</artifactId>
 <version>1.4.0</version>
</dependency>
<dependency>
 <groupId>org.apache.shiro</groupId>
 <artifactId>shiro-web</artifactId>
 <version>1.4.0</version>
</dependency>
<dependency>
 <groupId>org.apache.shiro</groupId>
 <artifactId>shiro-spring</artifactId>
 <version>1.4.0</version>
</dependency>

<!-- 配置shiro的過濾器工廠類，id- shiroFilter要和我們在web.xml中配置的過濾器一致 -->
<bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
 <property name="securityManager" ref="securityManager"/>
 <!-- 登錄頁面 -->
 <property name="loginUrl" value="/login"/>
 <!-- 登錄成功后的頁面 -->
 <property name="successUrl" value="/index"/>
 <!-- 非法訪問跳轉的頁面 -->
 <property name="unauthorizedUrl" value="/403"/>
 <!-- 權限配置 -->
 <property name="filterChainDefinitions">
 <value>
  <!-- 無需認證即可訪問的靜態(tài)資源，還可以添加其他 url -->
  /static/** = anon
  <!-- 除了上述忽略的資源，其他所有資源都需要認證后才能訪問 -->
  /** = authc
 </value>
 </property>
</bean>

public class MyRealm extends AuthorizingRealm {
 @Autowired
 private UserService userService;
 /**
 * 驗證權限
 */
 @Override
 protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {
 String loginName = SecurityUtils.getSubject().getPrincipal().toString();
 if (loginName != null) {
 String userId = SecurityUtils.getSubject().getSession().getAttribute("userSessionId").toString();
 // 權限信息對象,用來存放查出的用戶的所有的角色及權限
 SimpleAuthorizationInfo info = new SimpleAuthorizationInfo();
 // 用戶的角色集合
 ShiroUser shiroUser = (ShiroUser) principalCollection.getPrimaryPrincipal();
  info.setRoles(shiroUser.getRoles());
  info.addStringPermissions(shiroUser.getUrlSet());
 return info;
 }
 return null;
 }
 /**
 * 認證回調函數(shù),登錄時調用
 */
 protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) {
 String username = (String) token.getPrincipal();
 User user = new User();
 sysuser.setUsername(username);
 try {
 List<SysUser> users = userService.findByNames(user);
  List<String> roleList= userService.selectRoleNameListByUserId(users.get(0).getId());
 if (users.size() != 0) {
 String pwd = users.get(0).getPassword();
 // 當驗證都通過后，把用戶信息放在 session 里
 Session session = SecurityUtils.getSubject().getSession();
 session.setAttribute("userSession", users.get(0));
 session.setAttribute("userSessionId", users.get(0).getId());
 session.setAttribute("userRoles", org.apache.commons.lang.StringUtils.join(roleList,","));
  return new SimpleAuthenticationInfo(username,users.get(0).getPassword());
 } else {
  // 沒找到該用戶
 throw new UnknownAccountException();
 }
 } catch (Exception e) {
 System.out.println(e.getMessage());
 }
 return null;
 }
 /**
 * 更新用戶授權信息緩存.
 */
 public void clearCachedAuthorizationInfo(PrincipalCollection principals) {
 super.clearCachedAuthorizationInfo(principals);
 }
 /**
 * 更新用戶信息緩存.
 */
 public void clearCachedAuthenticationInfo(PrincipalCollection principals) {
 super.clearCachedAuthenticationInfo(principals);
 }
 /**
 * 清除用戶授權信息緩存.
 */
 public void clearAllCachedAuthorizationInfo() {
 getAuthorizationCache().clear();
 }
 /**
 * 清除用戶信息緩存.
 */
 public void clearAllCachedAuthenticationInfo() {
 getAuthenticationCache().clear();
 }
 /**
 * 清空所有緩存
 */
 public void clearCache(PrincipalCollection principals) {
 super.clearCache(principals);
 }
 /**
 * 清空所有認證緩存
 */
 public void clearAllCache() {
 clearAllCachedAuthenticationInfo();
 clearAllCachedAuthorizationInfo();
 }
}

@Controller
public class UserController {
 /**
 * 用戶登錄
 */
 @PostMapping("/login")
 public String login(@Valid User user,BindingResult bindingResult,RedirectAttributes redirectAttributes){
 try {
  if(bindingResult.hasErrors()){
  return "login";
  }
  //使用權限工具進行認證，登錄成功后跳到 shiroFilter bean 中定義的 successUrl
  SecurityUtils.getSubject().login(new UsernamePasswordToken(user.getUsername(), user.getPassword()));
  return "redirect:index";
 } catch (AuthenticationException e) {
  redirectAttributes.addFlashAttribute("message","用戶名或密碼錯誤");
  return "redirect:login";
 }
 }
 /**
 * 注銷登錄
 */
 @GetMapping（"/logout")
 public String logout(RedirectAttributes redirectAttributes ){
 SecurityUtils.getSubject().logout();
 return "redirect:login";
 }
}