<shiro.version>1.2.3</shiro.version  
     <dependency>
      <groupId>org.apache.shiro</groupId>
      <artifactId>shiro-core</artifactId>
      <version>${shiro.version}</version>
    </dependency>
    <dependency>
      <groupId>org.apache.shiro</groupId>
      <artifactId>shiro-web</artifactId>
      <version>${shiro.version}</version>
    </dependency>
    <dependency>
      <groupId>org.apache.shiro</groupId>
      <artifactId>shiro-spring</artifactId>
      <version>${shiro.version}</version>
    </dependency>
    <dependency>
      <groupId>org.apache.shiro</groupId>
      <artifactId>shiro-all</artifactId>
      <version>${shiro.version}</version>
    </dependency>
    <dependency>
      <groupId>org.apache.shiro</groupId>
      <artifactId>shiro-ehcache</artifactId>
      <version>${shiro.version}</version>
    </dependency>
    <dependency>
      <groupId>org.apache.shiro</groupId>
      <artifactId>shiro-quartz</artifactId>
      <version>${shiro.version}</version>
    </dependency>

 UsernamePasswordToken token = new UsernamePasswordToken(username, password);

    SecurityUtils.setSecurityManager(securityManager); // 注入SecurityManager安全管理器
    Subject subject = SecurityUtils.getSubject(); // 獲取Subject單例對(duì)象
    subject.login(token); // 登陸

 /**
 * 用戶登錄
 * @param user
 * @param model
 * @param remember
 * @return
 */
@RequestMapping("/login")
public String login(Student user,Model model,String remember) {
    ModelAndView view = new ModelAndView("loginerro");
    String msg = "";
    Subject subject = SecurityUtils.getSubject();
        UsernamePasswordToken token = new UsernamePasswordToken(user.getUsername(), user.getPassword(),user.getUsername());
        if(remember!=null){
            if(remember.equals("記住我")){//記住我
                token.setRememberMe(true);
            }
        }
        try {
            subject.login(token);
            return "main";
        } catch (IncorrectCredentialsException e) {
            model.addAttribute("errorMsg", "抱歉，您的密碼有誤");
        } catch (ExcessiveAttemptsException e) {
            msg = "登錄失敗次數(shù)過(guò)多";
            model.addAttribute("errorMsg", "登錄失敗次數(shù)過(guò)多");
            System.out.println(msg);
        } catch (LockedAccountException e) {
            msg = "帳號(hào)已被鎖定. The account for username " + token.getPrincipal() + " was locked.";
            model.addAttribute("errorMsg", "帳號(hào)已被鎖定");
            System.out.println(msg);
        } catch (DisabledAccountException e) {
            msg = "帳號(hào)已被禁用. The account for username " + token.getPrincipal() + " was disabled.";
            model.addAttribute("errorMsg", "帳號(hào)已被禁用");
            System.out.println(msg);
        } catch (ExpiredCredentialsException e) {
            msg = "帳號(hào)已過(guò)期. the account for username " + token.getPrincipal() + "  was expired.";
            model.addAttribute("errorMsg", "帳號(hào)已過(guò)期");
            System.out.println(msg);
        } catch (UnknownAccountException e) {
            model.addAttribute("errorMsg", e.getMessage());
        } catch (UnauthorizedException e) {
            msg = "您沒有得到相應(yīng)的授權(quán)！" + e.getMessage();
            model.addAttribute("errorMsg", "您沒有得到相應(yīng)的授權(quán)");
            System.out.println(msg);
        } catch (AccountException e) {
            msg = e.getMessage();
            model.addAttribute("errorMsg", e.getMessage());
            System.out.println(msg);
        }
        return "home";
}

 AuthenticationInfo getAuthenticationInfo(AuthenticationToken token)
boolean supports(AuthenticationToken token)
String getName()

public class LoginShiro extends AuthorizingRealm {
    private static final Logger logger = LogManager.getLogger(LoginShiro.class);
    @Autowired
    private UserServerInter userServerInter;
    @Autowired
    private RoleServerInter roleServerInter;
    @Autowired
    private PermissionServerInter permissionServerInter;
    @Autowired
    private UserDao userDao;
    @Override
    public String getName() {
        return "realm";
    }
    /**
     * 權(quán)限認(rèn)證
     * @param principalCollection
     * @return
     */
    @Override
    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {
        String currentUsername = (String)super.getAvailablePrincipal(principalCollection);
        System.out.print("AuthorizationInfo====："+currentUsername);
        SimpleAuthorizationInfo info =  new SimpleAuthorizationInfo();
        //根據(jù)用戶ID查詢角色（role），放入到Authorization里。
        Set<String> roles = roleServerInter.FindRoleByName(currentUsername);
        info.setRoles(roles);
        //根據(jù)用戶ID查詢權(quán)限（permission），放入到Authorization里。
        Set<String> permissions = permissionServerInter.findPermissionByName(currentUsername);
        info.setStringPermissions(permissions);
        return info;
    }
    /**
     * 身份認(rèn)證
     * @param authenticationToken
     * @return
     * @throws AuthenticationException
     */
    @Override
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken) throws AuthenticationException {
         SimpleAuthenticationInfo authenticationInfo = null;
        UsernamePasswordToken token=(UsernamePasswordToken) authenticationToken;
        String username = String.valueOf(token.getUsername());
        String password = new String(token.getPassword());
        Student user= userDao.FindUserByUserName(username);
        if (null != user) {
                authenticationInfo = new SimpleAuthenticationInfo(user.getUsername(), user.getPassword(), getName());
//                //鹽值：取用戶信息中唯一的字段來(lái)生成鹽值，避免由于兩個(gè)用戶原始密碼相同，加密后的密碼也相同
                authenticationInfo.setCredentialsSalt(ByteSource.Util.bytes(username+user.getSalt()));
        }else {
            throw new AccountException("當(dāng)前無(wú)此用戶！");
        }
        return authenticationInfo;
    }
    @Override
     public void clearCachedAuthorizationInfo(PrincipalCollection principals) {
                super.clearCachedAuthorizationInfo(principals);
    }
    @Override
     public void clearCachedAuthenticationInfo(PrincipalCollection principals) {
        super.clearCachedAuthenticationInfo(principals);
    }
    @Override
     public void clearCache(PrincipalCollection principals) {
        super.clearCache(principals);
    }
    public void clearAllCachedAuthorizationInfo() {
        getAuthorizationCache().clear();
    }
    public void clearAllCachedAuthenticationInfo() {
        getAuthenticationCache().clear();
    }
    /**
     * 清空緩存
     */
    public void clearAllCache() {
        clearAllCachedAuthenticationInfo();
        clearAllCachedAuthorizationInfo();
    }
}

<bean id="credentialsMatcher" class="com.sxkj.Common.RetryLimitHashedCredentialsMatcher">
        <constructor-arg ref="cacheManager" />
        <!--加密算法為md5-->
        <property name="hashAlgorithmName" value="md5" />
        <!--3次md5迭代  配置加密的次數(shù)-->
        <property name="hashIterations" value="2" />
        <!--是否存儲(chǔ)散列后的密碼為16進(jìn)制，需要和生成密碼時(shí)的一樣，默認(rèn)是base64-->
        <property name="storedCredentialsHexEncoded" value="true" />
    </bean>

 public class RetryLimitHashedCredentialsMatcher extends HashedCredentialsMatcher {
    private Cache  <    String, AtomicInteger> passwordRetryCache;
    public RetryLimitHashedCredentialsMatcher(CacheManager cacheManager) {
//        passwordRetryCache = cacheManager.getCache("passwordRetryCache");
    }
    @Override
    public boolean doCredentialsMatch(AuthenticationToken token,
                                      AuthenticationInfo info) {
//        Strin matches;
        String username = (String) token.getPrincipal();
//retrycount + 1
        Object element = EhcacheUtil.getItem(username);
        if (element == null) {
            EhcacheUtil.putItem(username, 1);
            element=0;
        }else{
            int count=Integer.parseInt(element.toString())+1;
            element=count;
            EhcacheUtil.putItem(username,element);
        }
        AtomicInteger retryCount = new AtomicInteger(Integer.parseInt(element.toString()));
        if (retryCount.incrementAndGet() > 5) {
//if retrycount >5 throw
            throw new ExcessiveAttemptsException();
        }
        boolean matches = super.doCredentialsMatch(token, info);
        if (matches) {
//clear retrycount
            EhcacheUtil.removeItem(username);
        }
        return matches;
    }
}

 /**
 * 退出登錄
 * @return
 */
@RequestMapping("/logout")
public String logout(){
    Subject subject = SecurityUtils.getSubject();
    Session session = subject.getSession();
    if (subject.isAuthenticated()) {
        System.out.println(session.getLastAccessTime());
        subject.logout();
    } else if(subject.isRemembered()) {
        subject.logout();
    }
    return "home";
}

 <!--Ehcache緩存管理器 -->
    <bean id="cacheManager" class="org.apache.shiro.cache.ehcache.EhCacheManager">
        <property name="cacheManagerConfigFile" value="classpath:ehcache.xml"></property>
    </bean>

public class EhcacheUtil {
    private static final CacheManager cacheManager = CacheManager.getInstance();
    /**
     * 創(chuàng)建ehcache緩存，創(chuàng)建之后的有效期是1小時(shí)
     */
    private static Cache cache = new Cache(new CacheConfiguration("systemCache", 5000).memoryStoreEvictionPolicy(MemoryStoreEvictionPolicy.FIFO).timeoutMillis(300).timeToLiveSeconds( 60 * 60));
    static {
        cacheManager.addCache(cache);
    }
    public static void putItem(String key, Object item) {
        if (cache.get(key) != null) {
            cache.remove(key);
        }
        Element element = new Element(key, item);
        cache.put(element);
    }
    public static void removeItem(String key) {
        cache.remove(key);
    }
    public static void updateItem(String key, Object value) {
        putItem(key, value);
    }
    public static Object getItem(String key) {
        Element element=  cache.get(key);
        if(null!=element)
        {
            return element.getObjectValue();
        }
        return null;
    }
}