<dependency>
			<groupId>org.apache.shiro</groupId>
			<artifactId>shiro-core</artifactId>
			<version>1.13.0</version>
		</dependency>
		
		<dependency>
			<groupId>org.apache.shiro</groupId>
			<artifactId>shiro-spring</artifactId>
			<version>1.13.0</version>
		</dependency>

package com.wzu.utilities.config.shiro;

import java.util.HashMap;
import java.util.LinkedHashMap;
import java.util.Map;

import javax.servlet.Filter;

import org.apache.shiro.mgt.SecurityManager;
import org.apache.shiro.spring.web.ShiroFilterFactoryBean;
import org.apache.shiro.web.mgt.DefaultWebSecurityManager;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.data.redis.core.ValueOperations;

@Configuration
public class ShiroConfig {

	@Bean(name = "shiroFilter")
	public ShiroFilterFactoryBean shiroFilter(SecurityManager securityManager, ValueOperations<String, Object> valueOperations, @Value("${shiro.session-timeout}") Long sessionTimeout) {
		ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();
		shiroFilterFactoryBean.setSecurityManager(securityManager);
		
		LinkedHashMap<String, String> filterChainDefinitionMap = new LinkedHashMap<>();
		filterChainDefinitionMap.put("/login", "anon");
        
        filterChainDefinitionMap.put("/**", "authc");
		shiroFilterFactoryBean.setFilterChainDefinitionMap(filterChainDefinitionMap);
		
        Map<String, Filter> filters = new HashMap<>();
        filters.put("authc", new MyAuthenticationFilter(valueOperations, sessionTimeout));
        shiroFilterFactoryBean.setFilters(filters);
		return shiroFilterFactoryBean;
	}
	
	@Bean
	public SecurityManager securityManager() {
		DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager();
		securityManager.setRealm(customRealm());
		return securityManager;
	}
	
	@Bean
	public CustomRealm customRealm() {
		return new CustomRealm();
	}
}

    @PostMapping("login")
	public R<User> login(String username, String password, HttpServletRequest request, HttpServletResponse response) {
		Subject subject = SecurityUtils.getSubject();
		User user = userMapper.selectOne(new QueryWrapper<User>().eq("username", username));
		if (user==null) {
			throw new AuthenticationException("用户名或密码错误");
		}
		UsernamePasswordToken token = new UsernamePasswordToken(username, MD5SecurityUtil.encryptMD5(password));
		subject.login(token);
		return R.ok(getCurrentLoginUser());
	}


    @PostMapping("logout")
    public R<User> logout() {
        Subject subject = SecurityUtils.getSubject();
        subject.getSession().removeAttribute(WebConstants.LOGIN_USER);
        subject.getSession().removeAttribute(WebConstants.LOGIN_USER_ID);
        String token = (String)subject.getSession().removeAttribute(WebConstants.LOGIN_USER_TOKEN);
        if(StringUtils.isNotBlank(token)) {
        	redisTemplate.delete(token);
        }
        subject.getSession().removeAttribute(WebConstants.LOGIN_USER_NAME);
        
        subject.logout();
        return R.ok();
    }

    @GetMapping("info")
	public R<User> getUserInfo() {
		User user = getCurrentLoginUser();;
		return R.ok(user);
	}

    public User getCurrentLoginUser() {
		 User user = (User) SecurityUtils.getSubject().getSession().getAttribute(WebConstants.LOGIN_USER);
		 if(user==null) {
			 throw new AccountException();
		 }
		 return user;
	 }

package com.wzu.utilities.web.aspect;


import org.apache.shiro.authc.AccountException;
import org.apache.shiro.authc.AuthenticationException;
import org.apache.shiro.authz.UnauthenticatedException;
import org.apache.shiro.authz.UnauthorizedException;
import org.springframework.web.bind.annotation.ControllerAdvice;
import org.springframework.web.bind.annotation.ExceptionHandler;
import org.springframework.web.bind.annotation.ResponseBody;

import com.wzu.utilities.entity.enums.ControllerResultEnum;
import com.wzu.utilities.entity.vo.R;

import lombok.extern.slf4j.Slf4j;

/**
 * @Author zhangyugu
 * @Date 2021/4/24 7:30 下午
 * @Version 1.0
 */
@Slf4j
@ControllerAdvice
public class WebExceptionHandler {

    @ResponseBody
    @ExceptionHandler
    public R exceptionHandler(Exception e) {
        log.error(e.getMessage(), e);
        if(e instanceof AccountException) {
            return R.fail(e.getMessage());
        }
        if(e instanceof UnauthorizedException) {
            return R.failWithCode(ControllerResultEnum.USER_HASNO_AUTH.getCode(), e.getMessage());
        }
        if(e instanceof AuthenticationException) {
            return R.failWithCode(ControllerResultEnum.NEED_LOGIN.getCode(), e.getMessage());
        }
        if(e instanceof UnauthenticatedException) {
            return R.failWithCode(ControllerResultEnum.NEED_LOGIN.getCode(), e.getMessage());
        }
        return R.fail(e.getMessage());
    }
}

package com.wzu.utilities.entity.enums;

/**
 * @Author zhangyugu
 * @Date 2021/4/8 11:47 上午
 * @Version 1.0
 */
public enum ControllerResultEnum {

    ERROR(300, "运行出错"),
    REQUEST_TIMEOUT(408, "请求超时"),
    SERVER_DOWN(503,"服务器超负载，或者停机维护"),

    NEED_LOGIN(7777, "需要登录"),
    USER_HASNO_AUTH(1003, "用户权限不足"),
    VIOLATION_EXCEPTION(1200, "验证数据出现错误!"),

    RESULT_NULL(1300,"结果为空！"),

    FILE_UPLOAD_PATH_NOT_EXIST(1503,"文件路径不存在");


    Integer code;

    String message;

    ControllerResultEnum(Integer code, String message) {
        this.code = code;
        this.message = message;
    }

    public Integer getCode() {
        return code;
    }

    public String getMessage() {
        return message;
    }
}

 @Bean
    public LifecycleBeanPostProcessor lifecycleBeanPostProcessor() {
        return new LifecycleBeanPostProcessor();
    }

    /**
     * 以下两个bean（其中DefaultAdvisorAutoProxyCreator可选）
     * 用于启用 @RequiresRoles 和 @RequiresPermissions 注解
     * @return
     */
    @Bean
    @DependsOn({"lifecycleBeanPostProcessor"})
    public DefaultAdvisorAutoProxyCreator advisorAutoProxyCreator() {
        DefaultAdvisorAutoProxyCreator advisorAutoProxyCreator = new DefaultAdvisorAutoProxyCreator();
        advisorAutoProxyCreator.setProxyTargetClass(true);
        return advisorAutoProxyCreator;
    }

    @Bean
    public AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor(SessionDAO sessionDAO) {
        AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor = new AuthorizationAttributeSourceAdvisor();
        authorizationAttributeSourceAdvisor.setSecurityManager(securityManager(sessionDAO));
        return authorizationAttributeSourceAdvisor;
    }

@Override
	protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {
		String token = (String) principals.getPrimaryPrincipal();
		String userStr = valueOperations.get(token);
		if (StringUtils.isBlank(userStr)) {
			throw new AccountException("登录失效，请重新登录");
		}
		
		User user = JSONObject.parseObject(userStr, User.class);
		SimpleAuthorizationInfo info = new SimpleAuthorizationInfo();
		info.setRoles(Sets.newHashSet(user.getRole()));
		//TODO:权限码 info.setStringPermissions();
		return info;
	}

@RequiresRoles("ADMIN") //验证角色
@RequiresRoles(value= {"ADMIN", "SUPER_ADMIN"}, logical=Logical.OR) //验证角色，ADMIN或者SUPER_ADMIN，注意需要用"或"
@RequiresPermissions("ADD_USER") //验证权限
@RequiresPermissions(value= {"ADD_USER", "DELETE_USER"}, logical=Logical.OR) //验证权限, ADD_USER 或 DELETE_USER