<dependency>
	  <groupId>org.springframework.boot</groupId>
	  <artifactId>spring-boot-starter-web</artifactId>
	</dependency>
	<dependency>
       <groupId>org.apache.shiro</groupId>
        <artifactId>shiro-spring-boot-starter</artifactId>
        <version>1.7.1</version>
     </dependency>
        <dependency>
			<groupId>com.baomidou</groupId>
			<artifactId>mybatis-plus-boot-starter</artifactId>
			<version>${mybatis-plus.version}</version>
		</dependency>
	<dependency>
		<groupId>mysql</groupId>
		<artifactId>mysql-connector-java</artifactId>
		<scope>runtime</scope>
	</dependency>
	<!--druid -->
		<dependency>
			<groupId>com.alibaba</groupId>
			<artifactId>druid-spring-boot-starter</artifactId>
			<version>${druid.version}</version>
		</dependency>

@Service
@Transactional(rollbackFor=Exception.class)
public class UserServiceImpl implements UserService
{
    @Autowired
    private UserMapper userMapper;
    //查詢用戶信息
    @Override
    public User getUserByUserId(String userId)
    {
        Assert.notNull(userId, "userId不能為空");
        User user= userMapper.getUserByUserId(userId);
        if(user==null)
        {
            throw new UnknownAccountException("用戶名或密碼不正確");
        }
        //
        if("0".equals(user.getActive()))
        {
            throw new UnknownAccountException("用戶狀態(tài)不正確");
        }
        return user;
    }
   //獲取用戶角色
    @Override
    public List<Role> getRolesByUserOid(Integer userOid)
    {
        Assert.notNull(userOid, "userOid不能為空");
        return userMapper.getRolesByUserOid(userOid);
    }
   //獲取用戶權(quán)限
    @Override
    public List<Func> getResByRoleOid(Collection<Integer> roleOids)
    {
        Assert.notNull(roleOids, "roleOid不能為空");
        return userMapper.getResByRoleOid(roleOids);
    }
}

public interface UserMapper extends BaseMapper<User>
{
    User getUserByUserId(String userId);
    List<Role> getRolesByUserOid(@Param("userOid")Integer userOid);
    List<Func> getResByRoleOid(@Param("roleOids")Collection<Integer> roleOids);
}

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE mapper PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN" "http://mybatis.org/dtd/mybatis-3-mapper.dtd">
<mapper namespace="com.skywares.fw.security.mapper.UserMapper">
<select id="getUserByUserId" resultType="com.skywares.fw.security.pojo.User">
      select 
        oid,
        userId,
        userName,
        active,
        gender,
        mobile,
        email,
        pwd        
      from fw_security_user u 
      where u.userId=#{userId}
 </select>
     <select id="getRolesByUserOid"  resultType="com.skywares.fw.security.pojo.Role">
        select 
		  r.oid,
		  r.roleId,
		  r.active,
		  r.updateUser,
		  r.updateDate
		from fw_security_user u 
		  join fw_security_user_role ur on ur.userOid = u.oid 
		  join fw_security_role r  on r.oid = ur.roleOid 
		 where u.active='1'
		   and u.oid =#{userOid}
    </select> 
      <select id="getResByRoleOid" resultType="com.skywares.fw.security.pojo.Func">
       select 
		  res.oid,
		  res.resId,
		  res.defaultLabel,
		  res.seq,
		  res.parentoid,
		  res.url,
		  res.exturl,
		  res.type,
		  res.active
        from  fw_security_res res 
		  join fw_security_role_res r on r.resOid = res.oid 
		  join fw_security_role role  on role.oid = r.roleOid 
		  where role.oid in
	         <foreach collection="roleOids" item="oid" open="(" close=")" separator=",">
	            #{oid}
	        </foreach>
		order BY res.oid desc
    </select>
</mapper>

public class CustomerRealm extends AuthorizingRealm 
{
    @Autowired
    private UserService userService;
    //授權(quán)認證
    @Override
    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection)
    {
        SimpleAuthorizationInfo info = new SimpleAuthorizationInfo();
        User user = (User) principalCollection.getPrimaryPrincipal();
        Integer userOid=user.getOid();
        List<Role> roleList= userService.getRolesByUserOid(userOid);
        //用戶角色
        Set<String> roleSet=new HashSet<>();
        //權(quán)限信息
        Set<String> funcSet=new HashSet<>();
        Set<Integer> roleOids=new HashSet<>();
        //查詢角色
        if(roleList!=null && !roleList.isEmpty())
        {
            roleList.stream().forEach(t->{
                roleSet.add(String.valueOf(t.getRoleId()));
                roleOids.add(t.getOid());
            });
        }
        //查詢權(quán)限
        List<Func> funcList= userService.getResByRoleOid(roleOids);
        if(funcList!=null && !funcList.isEmpty()){
            for(Func func:funcList)
            {
                funcSet.add(func.getUrl());
            }
        }
        //添加角色
        info.addRoles(roleSet);
        //添加權(quán)限
        info.addStringPermissions(funcSet);
        return info;
    }
    //用戶認證
    @Override
    protected AuthenticationInfo doGetAuthenticationInfo(
            AuthenticationToken authToken) throws AuthenticationException
    {        
        //采用用戶名和密碼方式
        UsernamePasswordToken usernamePasswordToken = (UsernamePasswordToken) authToken;
        String userId = usernamePasswordToken.getUsername();
        //密碼
        String password = new String(usernamePasswordToken.getPassword());
        // 通過用戶id獲取用戶信息
        User user = userService.getUserByUserId(userId);
        //認證。密碼進行加密處理 
        SimpleAuthenticationInfo info = new SimpleAuthenticationInfo(user, user.getPwd(),new CustByteSource(user.getUserId()),getName());
        return info;
    }
}

public class CustByteSource implements ByteSource, Serializable
{
    private static final long serialVersionUID = -3818806283942882146L;
    private byte[] bytes;
    private String cachedHex;
    private String cachedBase64;
    public CustByteSource()
    {
    }
    public CustByteSource(byte[] bytes)
    {
        this.bytes = bytes;
    }
    public CustByteSource(char[] chars)
    {
        this.bytes = CodecSupport.toBytes(chars);
    }
    public CustByteSource(String string)
    {
        this.bytes = CodecSupport.toBytes(string);
    }
    public CustByteSource(ByteSource source)
    {
        this.bytes = source.getBytes();
    }
    public CustByteSource(File file)
    {
        this.bytes = new CustByteSource.BytesHelper().getBytes(file);
    }
    public CustByteSource(InputStream stream)
    {
        this.bytes = new CustByteSource.BytesHelper().getBytes(stream);
    }
    public static boolean isCompatible(Object o)
    {
        return o instanceof byte[] || o instanceof char[]
                || o instanceof String || o instanceof ByteSource
                || o instanceof File || o instanceof InputStream;
    }
    @Override
    public byte[] getBytes()
    {
        return this.bytes;
    }
    @Override
    public boolean isEmpty()
    {
        return this.bytes == null || this.bytes.length == 0;
    }
    @Override
    public String toHex()
    {
        if (this.cachedHex == null)
        {
            this.cachedHex = Hex.encodeToString(getBytes());
        }
        return this.cachedHex;
    }
    @Override
    public String toBase64()
    {
        if (this.cachedBase64 == null)
        {
            this.cachedBase64 = Base64.encodeToString(getBytes());
        }
        return this.cachedBase64;
    }
    @Override
    public String toString()
    {
        return toBase64();
    }
    @Override
    public int hashCode()
    {
        if (this.bytes == null || this.bytes.length == 0)
        {
            return 0;
        }
        return Arrays.hashCode(this.bytes);
    }
    @Override
    public boolean equals(Object o)
    {
        if (o == this)
        {
            return true;
        }
        if (o instanceof ByteSource)
        {
            ByteSource bs = (ByteSource) o;
            return Arrays.equals(getBytes(), bs.getBytes());
        }
        return false;
    }
    private static final class BytesHelper extends CodecSupport
    {
        /**
         * 嵌套類也需要提供無參構(gòu)造器
         */
        private BytesHelper()
        {
        }
        public byte[] getBytes(File file)
        {
            return toBytes(file);
        }
        public byte[] getBytes(InputStream stream)
        {
            return toBytes(stream);
        }
    }
}

   public static final String md5Pwd(String salt,String pwd)
    {
        //加密方式
        String hashAlgorithmName = "MD5";
        //鹽：為了即使相同的密碼不同的鹽加密后的結(jié)果也不同
        ByteSource byteSalt = ByteSource.Util.bytes(salt);
        //加密次數(shù)
        int hashIterations = 2;
        SimpleHash result = new SimpleHash(hashAlgorithmName, pwd, byteSalt, hashIterations);
        return result.toString();
    }

@Configuration
public class ShiroConfig
{
   // 自定義密碼加密規(guī)則
    @Bean
    public HashedCredentialsMatcher hashedCredentialsMatcher()
    {
        HashedCredentialsMatcher hashedCredentialsMatcher =new HashedCredentialsMatcher();
        hashedCredentialsMatcher.setHashAlgorithmName("md5");
        hashedCredentialsMatcher.setHashIterations(2);
        //true 代表Hex編碼，fasle代表采用base64編碼
        hashedCredentialsMatcher.setStoredCredentialsHexEncoded(true);
        return hashedCredentialsMatcher;
    }
    // 自定義認證
    @Bean
    public CustomerRealm customerRealm()
    {
        CustomerRealm customerRealm=new  CustomerRealm();
        customerRealm.setCredentialsMatcher(hashedCredentialsMatcher());
        customerRealm.setCachingEnabled(false);
        return customerRealm;
    }
    //需要定義DefaultWebSecurityManager，否則會報bean沖突
    @Bean
    public DefaultWebSecurityManager securityManager() 
    {
        DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager();
        securityManager.setRealm(customerRealm());
        securityManager.setRememberMeManager(null);
        return securityManager;
    }
    @Bean
    public ShiroFilterFactoryBean shiroFilterFactoryBean(DefaultWebSecurityManager securityManager)
    {
        ShiroFilterFactoryBean factoryBean = new ShiroFilterFactoryBean();
        //給filter設(shè)置安全管理
        factoryBean.setSecurityManager(securityManager);
        //配置系統(tǒng)的受限資源
        Map<String,String> map = new HashMap<>();
        //登錄請求無需認證
        map.put("/login", "anon");
        //其他請求需要認證
        map.put("/**", "authc");
        //訪問需要認證的頁面如果未登錄會跳轉(zhuǎn)到/login
        factoryBean.setLoginUrl("/login");
        //訪問未授權(quán)頁面會自動跳轉(zhuǎn)到/unAuth
        factoryBean.setUnauthorizedUrl("/unAuth");
        factoryBean.setFilterChainDefinitionMap(map);
        return factoryBean;
    }
    /**
     * 開啟注解方式，頁面可以使用注解
     * @param securityManager
     * @return
     */
    @Bean
    public AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor(SecurityManager securityManager) {
        AuthorizationAttributeSourceAdvisor advisor = new AuthorizationAttributeSourceAdvisor();
        advisor.setSecurityManager(securityManager);
        return advisor;
    }
}

// 登錄測試
@Controller
@RequestMapping("")
public class LoginController
{
   @RequestMapping("/login")
   @ResponseBody
   public String login(@RequestParam String userName,@RequestParam String password)
   {
     Subject subject = SecurityUtils.getSubject();
     UsernamePasswordToken usernamePasswordToken =new UsernamePasswordToken(userName, password);
     subject.login(usernamePasswordToken);
     return "成功";
   }
      /**
    * 用戶未登錄
    * @return
    */
   @RequestMapping("/unLogin")
   public String unLogin()
   {
     return "login.html";
   }
   /**
    * 用戶未授權(quán)
    * @return
    */
   @RequestMapping("/unAuth")
   public String unAuth()
   {
     return "unAuth.html";
   }
}
// 角色和權(quán)限測試
@RestController
@RequestMapping("/app/sys/user")
public class UserController
{
   @RequestMapping("/list")
   @RequiresPermissions("/app/sys/user/list")
   public String list()
   {
       return "成功";
   }
   @RequestMapping("/roleTest")
   @RequiresRoles("admin1")
   public String roleTest()
   {
       return "成功";
   }
   @RequestMapping("/resourceTest")
   @RequiresPermissions("/app/sys/user/list1")
   public String resourceTest()
   {
       return "成功";
   }
}

//訪問需要認證的頁面如果未登錄會跳轉(zhuǎn)到/login路由進行登陸
factoryBean.setLoginUrl("/unLogin");