Spring MVC整合Shiro权限控制的方法

/**
 * 用户
 */
public class User {
 private Integer id;
 private String username;
 private String password;
 //getter & setter...
}

/**
 * 角色
 */
public class Role {
 private String id;
 private String rolename;
}

/**
 * 资源
 */
public class Resource {
 private String id;
 private String resname;
}

/**
 * 角色-资源
 */
public class RoleRes {
 private String id;
 private String roleid;
 private String resid;
}

/**
 * 用户-角色
 */
public class UserRole {
 private String id;
 private String userid;
 private String roleid;
}

<dependency>
 <groupId>org.apache.shiro</groupId>
 <artifactId>shiro-core</artifactId>
 <version>1.4.0</version>
</dependency>
<dependency>
 <groupId>org.apache.shiro</groupId>
 <artifactId>shiro-web</artifactId>
 <version>1.4.0</version>
</dependency>
<dependency>
 <groupId>org.apache.shiro</groupId>
 <artifactId>shiro-spring</artifactId>
 <version>1.4.0</version>
</dependency>

<!-- 配置shiro的过滤器工厂类，id- shiroFilter要和我们在web.xml中配置的过滤器一致 -->
<bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
 <property name="securityManager" ref="securityManager"/>
 <!-- 登录页面 -->
 <property name="loginUrl" value="/login"/>
 <!-- 登录成功后的页面 -->
 <property name="successUrl" value="/index"/>
 <!-- 非法访问跳转的页面 -->
 <property name="unauthorizedUrl" value="/403"/>
 <!-- 权限配置 -->
 <property name="filterChainDefinitions">
 <value>
  <!-- 无需认证即可访问的静态资源，还可以添加其他 url -->
  /static/** = anon
  <!-- 除了上述忽略的资源，其他所有资源都需要认证后才能访问 -->
  /** = authc
 </value>
 </property>
</bean>

public class MyRealm extends AuthorizingRealm {
 @Autowired
 private UserService userService;
 /**
 * 验证权限
 */
 @Override
 protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {
 String loginName = SecurityUtils.getSubject().getPrincipal().toString();
 if (loginName != null) {
 String userId = SecurityUtils.getSubject().getSession().getAttribute("userSessionId").toString();
 // 权限信息对象,用来存放查出的用户的所有的角色及权限
 SimpleAuthorizationInfo info = new SimpleAuthorizationInfo();
 // 用户的角色集合
 ShiroUser shiroUser = (ShiroUser) principalCollection.getPrimaryPrincipal();
  info.setRoles(shiroUser.getRoles());
  info.addStringPermissions(shiroUser.getUrlSet());
 return info;
 }
 return null;
 }
 /**
 * 认证回调函数,登录时调用
 */
 protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) {
 String username = (String) token.getPrincipal();
 User user = new User();
 sysuser.setUsername(username);
 try {
 List<SysUser> users = userService.findByNames(user);
  List<String> roleList= userService.selectRoleNameListByUserId(users.get(0).getId());
 if (users.size() != 0) {
 String pwd = users.get(0).getPassword();
 // 当验证都通过后，把用户信息放在 session 里
 Session session = SecurityUtils.getSubject().getSession();
 session.setAttribute("userSession", users.get(0));
 session.setAttribute("userSessionId", users.get(0).getId());
 session.setAttribute("userRoles", org.apache.commons.lang.StringUtils.join(roleList,","));
  return new SimpleAuthenticationInfo(username,users.get(0).getPassword());
 } else {
  // 没找到该用户
 throw new UnknownAccountException();
 }
 } catch (Exception e) {
 System.out.println(e.getMessage());
 }
 return null;
 }
 /**
 * 更新用户授权信息缓存.
 */
 public void clearCachedAuthorizationInfo(PrincipalCollection principals) {
 super.clearCachedAuthorizationInfo(principals);
 }
 /**
 * 更新用户信息缓存.
 */
 public void clearCachedAuthenticationInfo(PrincipalCollection principals) {
 super.clearCachedAuthenticationInfo(principals);
 }
 /**
 * 清除用户授权信息缓存.
 */
 public void clearAllCachedAuthorizationInfo() {
 getAuthorizationCache().clear();
 }
 /**
 * 清除用户信息缓存.
 */
 public void clearAllCachedAuthenticationInfo() {
 getAuthenticationCache().clear();
 }
 /**
 * 清空所有缓存
 */
 public void clearCache(PrincipalCollection principals) {
 super.clearCache(principals);
 }
 /**
 * 清空所有认证缓存
 */
 public void clearAllCache() {
 clearAllCachedAuthenticationInfo();
 clearAllCachedAuthorizationInfo();
 }
}

@Controller
public class UserController {
 /**
 * 用户登录
 */
 @PostMapping("/login")
 public String login(@Valid User user,BindingResult bindingResult,RedirectAttributes redirectAttributes){
 try {
  if(bindingResult.hasErrors()){
  return "login";
  }
  //使用权限工具进行认证，登录成功后跳到 shiroFilter bean 中定义的 successUrl
  SecurityUtils.getSubject().login(new UsernamePasswordToken(user.getUsername(), user.getPassword()));
  return "redirect:index";
 } catch (AuthenticationException e) {
  redirectAttributes.addFlashAttribute("message","用户名或密码错误");
  return "redirect:login";
 }
 }
 /**
 * 注销登录
 */
 @GetMapping（"/logout")
 public String logout(RedirectAttributes redirectAttributes ){
 SecurityUtils.getSubject().logout();
 return "redirect:login";
 }
}