这可能是最全的Shiro入门（整合SSM）

[main]
securityManager.属性=值
xiaolin=123456
securityManager.对象属性=$xiaolin

[users]
# 定义用户名为zhangsan 密码为zs
zhangsan=zs
# 定义用户名lisi密码为lisi同时具有role1和role2两个角色
lisi=lisi,role1,role2

[roles]
role1=权限名1,权限名2 
role2=权限3,权限4

[urls]
#url地址=内置filter或自定义filter
# 访问时出现/login的url必须去认证.支持authc对应的Filter 
/login=authc
# 任意的url都不需要进行认证等功能.
/** = anon
# 所有的内容都必须保证用户已经登录.
/**=user
# url abc 访问时必须保证用户具有role1和role2角色.
/abc=roles[“role1,role2”]

<dependency>
    <groupId>commons-logging</groupId>
    <artifactId>commons-logging</artifactId>
    <version>1.1.3</version>
</dependency>
<dependency>
    <groupId>org.apache.shiro</groupId>
    <artifactId>shiro-core</artifactId>
    <version>1.5.2</version>
</dependency>

<dependency>
    <groupId>junit</groupId>
    <artifactId>junit</artifactId>
    <version>4.13.2</version>
</dependency>
<dependency>
    <groupId>org.projectlombok</groupId>
    <artifactId>lombok</artifactId>
    <version>1.16.22</version>
    <scope>provided</scope>
</dependency>

[users]
xiaolin=666
zs=13

 /**
  * 用于测试Shiro基础
  */
  @Test
  public void testShiroBase(){
    // 创建Shiro安全管理器，是Shiro的核心
    DefaultSecurityManager securityManager = new DefaultSecurityManager();
    // 加载ini配置文件，得到配置文件中配置的用户信息
    IniRealm iniRealm = new IniRealm("classpath:shiro-authc.ini");
    // 将realm对象注入到securityManager中
    securityManager.setRealm(iniRealm);
    // 将安全管理器注入到当前环境中
    SecurityUtils.setSecurityManager(securityManager);
    // 获取subject主体对象，无论是否登录都可以获取
    Subject subject = SecurityUtils.getSubject();
    // 打印一下认证状态
    System.out.println("认证状态"+subject.isAuthenticated());
    // 创建一个携带了账号和密码的令牌
    UsernamePasswordToken token = new UsernamePasswordToken("xiaolin", "666");
    // 调用subject传入令牌进行登录
    subject.login(token);
    System.out.println("认证状态"+subject.isAuthenticated());
  }

// 认证
public class SimpleAccountRealm extends AuthorizingRealm {
		//.......省略
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
        UsernamePasswordToken upToken = (UsernamePasswordToken) token;
        SimpleAccount account = getUser(upToken.getUsername());

        if (account != null) {

            if (account.isLocked()) {
                throw new LockedAccountException("Account [" + account + "] is locked.");
            }
            if (account.isCredentialsExpired()) {
                String msg = "The credentials for account [" + account + "] are expired";
                throw new ExpiredCredentialsException(msg);
            }

        }

        return account;
    }

    // 授权
    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {
        String username = getUsername(principals);
        USERS_LOCK.readLock().lock();
        try {
            return this.users.get(username);
        } finally {
            USERS_LOCK.readLock().unlock();
        }
    }
}

<properties>
	<shiro.version>1.5.2</shiro.version>
</properties>
<!--shiro 核心-->
<dependency>
    <groupId>org.apache.shiro</groupId>
    <artifactId>shiro-core</artifactId>
    <version>${shiro.version}</version>
</dependency>
<!--shiro 的 Web 模块-->
<dependency>
    <groupId>org.apache.shiro</groupId>
    <artifactId>shiro-web</artifactId>
    <version>${shiro.version}</version>
</dependency>
<!--shiro 和 Spring 集成-->
<dependency>
    <groupId>org.apache.shiro</groupId>
    <artifactId>shiro-spring</artifactId>
    <version>${shiro.version}</version>
</dependency>
<!--shiro 底层使用的 ehcache 缓存-->
<dependency>
    <groupId>org.apache.shiro</groupId>
    <artifactId>shiro-ehcache</artifactId>
    <version>${shiro.version}</version>
</dependency>
<!--shiro 依赖的日志包-->
<dependency>
    <groupId>commons-logging</groupId>
    <artifactId>commons-logging</artifactId>
    <version>1.2</version>
</dependency>
<!--Freemarker 的 shiro 标签库-->
<dependency>
    <groupId>net.mingsoft</groupId>
    <artifactId>shiro-freemarker-tags</artifactId>
    <version>1.0.1</version>
</dependency>

<filter>
    <filter-name>shiroFilter</filter-name>
    <filter-class>
        org.springframework.web.filter.DelegatingFilterProxy
    </filter-class>
</filter>
<filter-mapping>
    <filter-name>shiroFilter</filter-name>
    <url-pattern>/*</url-pattern>
</filter-mapping>

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd">

    <!--自定义Realm-->
  <bean id="myRealm" class="cn.linstudy.shiro.CarBusinessRealm"/>
    <!--创建安全管理器-->
  <bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
    <property name="realm" ref="myRealm"/>
  </bean>
  <bean id="shiroFilter"
    class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
    <!--引用指定的安全管理器-->
    <property name="securityManager" ref="securityManager"/>
    <!--shiro默认的登录地址是/login.jsp 现在要指定我们自己的登录页面地址-->
    <property name="loginUrl" value="/login.html"/>
    <!--路径对应的规则-->
    <property name="filterChainDefinitions">
      <!--配置请求拦截的方式，是可以匿名还是-->
      <value>
        /empLogin=anon
        /static/**=anon
        /upload/**=anon
        /getImage=anon
        /getEmailCode=anon
        /checkEmail=anon
        /checkUsername=anon
        /error=anon
        /fronted/**=anon
        /**=authc
      </value>
    </property>
  </bean>
</beans>

<import resource="classpath:shiro.xml"/>

<bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager"></bean>

public class CarBusinessRealm extends AuthorizingRealm {  
@Autowired
  private EmployeeService employeeService;

  // 认证
  @Override
  protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token)
      throws AuthenticationException {
    // 通过token获取用户名（用户登录的时候）
    String username = (String) token.getPrincipal();
    // 判断是否存在在数据库
    Employee employee = employeeService.selectByUsername(username);
    if (employee != null) {
      // 说明此时用户名是对的，返回一个身份对象
      return new SimpleAuthenticationInfo(employee, employee.getPassword(), this.getName());
    }
    return null;
  }
}

<bean id="myRealm" class="cn.linstudy.shiro.CarBusinessRealm"/>
  <bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
    <property name="realm" ref="myRealm"/>
  </bean>	

      try {
        UsernamePasswordToken token = new UsernamePasswordToken(username, password);
        SecurityUtils.getSubject().login(token);
        Employee employee = employeeMapper.selectByUsername(username);
        return employee;
      } catch (UnknownAccountException e) {
        throw new CarBussinessException("用户名错误");
      } catch (IncorrectCredentialsException e) {
        throw new CarBussinessException("密码错误");
      }

if(subject.hasRole("admin")){//主体具有admin角色
   //操作什么资源
}

if(subject.isPermission("user:find:*")){ //对用户模块的所有用户有查询权限
  //对01用户进行修改
}
if(subject.isPermission("user:*:01")){  //user模块下的所有用户有所有权限
  //对01用户进行修改
}

Subject subject = SecurityUtils.getSubject();
if(subject.hasRole(“admin”)) {
	//有权限
} else {
	//无权限
}

@RequiresRoles("admin")
public void hello() {
	//有权限
}

JSP标签：在JSP 页面通过相应的标签完成：
<shiro:hasRole name="admin">
	<!— 有权限—>
</shiro:hasRole>
注意: Thymeleaf/FreeMarker 中使用shiro需要额外集成!

#用户的身份、凭据、角色
[users]
zhangsan=555,hr,seller
xiaolin=123,hr

#角色与权限信息
[roles]
hr=employee:list,employee:delete
seller=customer:list,customer:save

@Test
public void testAuthor(){
    //创建Shiro的安全管理器，是shiro的核心
    DefaultSecurityManager securityManager = new DefaultSecurityManager();
    //加载shiro.ini配置，得到配置中的用户信息（账号+密码）
    IniRealm iniRealm = new IniRealm("classpath:shiro-author.ini");
    securityManager.setRealm(iniRealm);
    //把安全管理器注入到当前的环境中
    SecurityUtils.setSecurityManager(securityManager);
    //无论有无登录都可以获取到subject主体对象，但是判断登录状态需要利用里面的属性来判断
    Subject subject = SecurityUtils.getSubject();
    System.out.println("认证状态："+subject.isAuthenticated());
    //创建令牌(携带登录用户的账号和密码)
    UsernamePasswordToken token = new UsernamePasswordToken("dafei","666");
    //执行登录操作(将用户的和 ini 配置中的账号密码做匹配)
    subject.login(token);
    System.out.println("认证状态："+subject.isAuthenticated());
    //登出
    //subject.logout();
    //System.out.println("认证状态："+subject.isAuthenticated());
    
    //判断用户是否有某个角色
    System.out.println("role1:"+subject.hasRole("role1"));
    System.out.println("role2:"+subject.hasRole("role2"));

    //是否同时拥有多个角色
    System.out.println("是否同时拥有role1和role2："+subject.hasAllRoles(Arrays.asList("role1", "role2")));

    //check开头的是没有返回值的，当没有权限时就会抛出异常
    subject.checkRole("hr");

    //判断用户是否有某个权限
    System.out.println("user:delete:"+subject.isPermitted("user:delete"));
    subject.checkPermission("user:delete");
}

public class EmployeeRealm extends AuthorizingRealm {
    //提供认证信息
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) 
        throws AuthenticationException {
        //暂且使用假数据来模拟数据库中真实的账号和密码
        Employee employee = new Employee();
        employee.setName("admin");
        employee.setPassword("1");
        //获取token中需要登录的账号名
        String username = (String)token.getPrincipal();
        //如果账号存在，则返回一个 AuthenticationInfo 对象
        if(username.equals(employee.getName())){
            return new SimpleAuthenticationInfo(
                employee,//身份对象，与主体subject绑定在一起的对象,暂时无用但后续要用 
                employee.getPassword(),//该账号真正的密码，传给shiro做密码校验的
                this.getName()//当前 Realm 的名称,暂时无用，不需纠结
            );
        }
        return null;
    }
	//提供授权信息
    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {
        //登录成功用户对象
        Employee employee = (Employee)principals.getPrimaryPrincipal();
        SimpleAuthorizationInfo info = new SimpleAuthorizationInfo();
        // 根据登录用户的id查询到其拥有的所有角色的编码,这里进行模拟数据库
        List<String> roleSns = Arrays.asList("hr","manager","seller");
        // 将用户拥有的角色添加到授权信息对象中，供 Shiro 权限校验时使用
        info.addRoles(roleSns);
        // 根据登录用户的 id 查询到其拥有的所有权限表达式,这里进行模拟数据库
        List<String> expressions = Arrays.asList("employee:list","employee:save");
        // 将用户拥有的权限添加到授权信息对象中，供 Shiro 权限校验时使用
        info.addStringPermissions(expressions);
        return info;
    }
}

  // 说明需要有这个权限才可以访问这个方法 
  @RequiresPermissions(value = "employee:list")
  @RequestMapping("list")
  public String listAll(@ModelAttribute("qo") EmployeeQueryObject employeeQueryObject, Model model,
      DepartmentQueryObject departmentQueryObject) {
    PageInfo<Employee> pageInfo = employeeService.selectForPage(employeeQueryObject);
    List<Department> departments = departmentService.selectAll();
    List<Role> roles = roleService.selectAll();
    model.addAttribute("departments", departments);
    model.addAttribute("roles", roles);
    model.addAttribute("pageInfo", pageInfo);
    return "employee/list";
  }

<!-- <aop:config/> 会扫描配置文件中的所有advisor，并为其创建代理 -->
<aop:config />
<!-- Pointcut advisor通知器， 会匹配所有加了shiro权限注解的方法 -->
<bean class="org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor">
    <property name="securityManager" ref="securityManager"/>
</bean>

// 授权
  @Override
  protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {
    // 创建info对象
    SimpleAuthorizationInfo info = new SimpleAuthorizationInfo();
    // 获取当前登录主体对象
    //Subject subject = SecurityUtils.getSubject();
    // 获取主体的身份对象（这里获取的对象与认证方法doGetAuthenticationInfo返回的SimpleAuthenticationInfo对象的第一个参数是同一个对象）
    Subject subject = SecurityUtils.getSubject();
    Employee employee = (Employee) subject.getPrincipal();
    // 判断是否是超级管理员
    if (employee.getAdmin()) {
      info.addRole("admin");
      // 给他所有的权限
      info.addStringPermission(" *:* ");
    } else {
      // 通过员工id拿到所有的角色
      List<Role> roles = employeeService.selectRolesById(employee.getId());
      for (Role role : roles) {
        info.addRole(role.getSn());
      }
      //通过员工id查询出所有的权限
      List<String> permissionByEmployeeId = employeeService
          .getPermissionByEmployeeId(employee.getId());
      info.addStringPermissions(permissionByEmployeeId);
    }
    return info;
  }

 @ExceptionHandler(AuthorizationException.class)
  public String BussinessException(AuthorizationException exception, HttpServletResponse response,
      HandlerMethod method) throws IOException {
    exception.printStackTrace(); //方便开发的时候找bug
    //如果原本控制器的方法是返回jsonresult数据,现在出异常也应该返回jsonresult
    //获取当前出现异常的方法,判断是否有ResponseBody注解,有就代表需要返回jsonresult
    if (method.hasMethodAnnotation(ResponseBody.class)) {
      try {
        response.setContentType("application/json;charset=UTF-8");
        response.getWriter().print(JSON.toJSONString(new ResponseResult(false, "没有权限操作")));
      } catch (IOException e1) {
        e1.printStackTrace();
      }
      return null;
    }
    //如果原本控制器的方法是返回视图页面,现在也应该返回视图页面
    return "common/nopermission";
  }

public class ShiroFreeMarkerConfig extends FreeMarkerConfigurer {
  
  @Override
  public void afterPropertiesSet() throws IOException, TemplateException {
    //继承之前的属性配置，这不能省
    super.afterPropertiesSet();
    Configuration cfg = this.getConfiguration();
    cfg.setSharedVariable("shiro", new ShiroTags());//注册shiro 标签，这里可以换成自己想要其他的标签，但是一般建议是用shiro
  }
}

  <!-- 注册 FreeMarker 配置类 -->
  <bean class="cn.linstudy.shiro.ShiroFreeMarkerConfig">
    <!-- 配置 FreeMarker 的文件编码 -->
    <property name="defaultEncoding" value="UTF-8"/>
    <!-- 配置 FreeMarker 寻找模板的路径 -->
    <property name="templateLoaderPath" value="/WEB-INF/views/"/>
    <property name="freemarkerSettings">
      <props>
        <!-- 兼容模式 ，配了后不需要另外处理空值问题，时间格式除外 -->
        <prop key="classic_compatible">true</prop>
        <!-- 数字格式化 , 不会有,字符串的 -->
        <prop key="number_format">0.##</prop>
      </props>
    </property>
  </bean>

<@shiro.authenticated> </@shiro.authenticated>

<@shiro.notAuthenticated></@shiro.notAuthenticated>

<@shiro.principal property="name" />

<@shiro.hasRole name="admin">Hello admin!</@shiro.hasRole>

<@shiro.hasAnyRoles name="admin,user">Hello admin</@shiro.hasAnyRoles>

<@shiro.hasPermission name="department:delete">删除</@shiro.hasPermission>

value={"employee:list","employee:delete", }

  // shiro注解无法使用name属性，所以约定，value中第一个位置的值是权限表达式，第二个位置的值是权限名称.
  // 但是 logical 的值必须是Logical.OR
  @RequiresPermissions(value = {"employee:list", "员工列表"}, logical = Logical.OR)
  @RequestMapping("list")
  public String listAll(@ModelAttribute("qo") EmployeeQueryObject employeeQueryObject, Model model,
      DepartmentQueryObject departmentQueryObject) {
    PageInfo<Employee> pageInfo = employeeService.selectForPage(employeeQueryObject);
    List<Department> departments = departmentService.selectAll();
    List<Role> roles = roleService.selectAll();
    model.addAttribute("departments", departments);
    model.addAttribute("roles", roles);
    model.addAttribute("pageInfo", pageInfo);
    return "employee/list";
  }

 public void reload() {
    //一次性的把所有的权限信息查出来.
    List<Permission> permissionsOnDB = permissionMapper.selectAll();
    // 拿到所有方法
    Map<RequestMappingInfo, HandlerMethod> handlerMethods = rmhm.getHandlerMethods();
    // 遍历所有方法
    for (HandlerMethod method : handlerMethods.values()) {
      // 判断方法上是否有RequiresPermissions注解
      RequiresPermissions annotation = method.getMethodAnnotation(RequiresPermissions.class);
      if (annotation != null) {
        // 如果不为空。说明是贴了注解的
        // 数组的第一个元素表示的是权限表达式
        String expression = annotation.value()[0];
        // 数组的第二个元素表示的是权限的名称
        String name = annotation.value()[1];
        // 在存入数据库之前先判断以下，如果数据库中没有才插入
        if (!permissionsOnDB.contains(expression)) {
          Permission permission = new Permission();
          permission.setName(name);
          permission.setExpression(expression);
          permissionMapper.insert(permission);
        }
      }
    }
  }

@RequestMapping("checkUsername")
  @ResponseBody
  public ResponseResult checkUsername(String username, String password, HttpSession session) {
    Employee employee = employeeService.selectByUsername(username);
    if (employee == null) {
      // 进行MD5密码加密
      Md5Hash md5Hash = new Md5Hash(password, username, 1024);
      EmployeeInsertVO employeeVO = new EmployeeInsertVO(username, username, md5Hash.toString(),
          session.getAttribute("EMAIL_IN_SESSION").toString(), false, true);
      employeeService.regsiter(employeeVO);
      return new ResponseResult(true, "注册成功");
    } else {
      return new ResponseResult(false, "用户名已存在");
    }
  }

try {
        // 对传进来的密码进行加密
        Md5Hash md5Hash = new Md5Hash(password, username, 1024);
        UsernamePasswordToken token = new UsernamePasswordToken(username, md5Hash.toString());
        SecurityUtils.getSubject().login(token);
        Employee employee = employeeMapper.selectByUsername(username);
        return employee;
      } catch (UnknownAccountException e) {
        throw new CarBussinessException("用户名错误");
      } catch (IncorrectCredentialsException e) {
        throw new CarBussinessException("密码错误");
      }
}

<!--引入shiro和ehcache-->
<dependency>
  <groupId>org.apache.shiro</groupId>
  <artifactId>shiro-ehcache</artifactId>
  <version>1.5.3</version>
</dependency>

<ehcache>
    <defaultCache
            maxElementsInMemory="1000"
            eternal="false"
            timeToIdleSeconds="600"
            timeToLiveSeconds="600"
            memoryStoreEvictionPolicy="LRU">
    </defaultCache>
</ehcache>

<!--安全管理器-->
<bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
    <!--注册自定义数据源-->
    <property name="realm" ref="employeeRealm"/>
    <!--注册缓存管理器-->
    <property name="cacheManager" ref="cacheManager"/>
</bean>

<!-- 缓存管理器 -->
<bean id="cacheManager" class="org.apache.shiro.cache.ehcache.EhCacheManager"> 
    <!-- 设置配置文件 -->
    <property name="cacheManagerConfigFile" value="classpath:shiro-ehcache.xml"/>
</bean>