<dependency>

    <groupId>org.apache.shiro</groupId>

    <artifactId>shiro-spring</artifactId>

    <version>1.4.0</version>

    <exclusions>

        <exclusion>

            <artifactId>slf4j-api</artifactId>

            <groupId>org.slf4j</groupId>

        </exclusion>

    </exclusions>

</dependency>

# =======================

shiro.ini 示例文件的内容

# =======================

# -----------------------------------------------------------------------------

# Users and their (optional) assigned roles

# username = password, role1, role2, ..., roleN

# -----------------------------------------------------------------------------

[users]

root = secret, admin

guest = guest, guest

presidentskroob = 12345, president

darkhelmet = ludicrousspeed, darklord, schwartz

aihe = aihe, goodguy, client

# -----------------------------------------------------------------------------

# Roles with assigned permissions

# roleName = perm1, perm2, ..., permN

# -----------------------------------------------------------------------------

[roles]

admin = *

client = look:*

goodguy = winnebago:drive:eagle5

@Override

public void run(String... args) throws Exception {

    // 创建sessionFactory，使用ini配置文件初始化

    IniSecurityManagerFactory factory = new IniSecurityManagerFactory("classpath:shiro.ini");

    // 创建securityManager实例

    SecurityManager securityManager = factory.getInstance();

    // 将securityManager配置在当前运行环境中

    SecurityUtils.setSecurityManager(securityManager);

    // 获取当前的subject

    Subject currentUser = SecurityUtils.getSubject();

    // session 操作

    Session session = currentUser.getSession();

    System.out.println("Id:" + session.getId());

    session.setAttribute("name", "value");

    System.out.println(session.getAttribute("name"));

    if (!currentUser.isAuthenticated()) {

        // 登录需要一个 token

        UsernamePasswordToken token = new UsernamePasswordToken("root", "secret");

        // 在 token 上设置 RememberMe

        // token.setRememberMe(true);

        // 登录

        currentUser.login(token);

        // 登录后可获取认证身份(一个或多个)

        PrincipalCollection principals = currentUser.getPrincipals();

        for (Object principal : principals) {

            System.out.println(principal.toString());

        }

        // 角色检查

        boolean granted1 = currentUser.hasRole("admin");

        System.out.println("hasRole('admin'):" + granted1);

        boolean granted2 = currentUser.hasRole("winnebago:drive");

        System.out.println("hasRole('winnebago:drive'):" + granted1);

        // 角色检查断言, 如果没有对应的角色, 会抛出 AuthorizationExceptions

        currentUser.checkRole("admin");

        // 权限检查

        boolean granted3 = currentUser.isPermitted("winnebago:drive");

        System.out.println("isPermitted('winnebago:drive'):" + granted2);

        // 权限检查断言, 如果没有对应的权限, 会抛出 AuthorizationExceptions

        currentUser.checkPermission("winnebago:drive");

        // 登出

        currentUser.logout();

    } else {

        System.out.println("you have login");

    }

}