<dependency>
 <groupId>org.apache.shiro</groupId>
 <artifactId>shiro-spring</artifactId>
 <version>1.4.0</version>
</dependency>

<filter>
 <filter-name>shiroFilter</filter-name>
 <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
 <init-param>
  <param-name>targetFilterLifecycle</param-name>
  <param-value>true</param-value>
 </init-param>
</filter>
<filter-mapping>
 <filter-name>shiroFilter</filter-name>
 <url-pattern>/*</url-pattern>
</filter-mapping>

<bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
 <property name="securityManager" ref="securityManager"/>
 <property name="loginUrl" value="/login.jsp"/>
 <property name="successUrl" value="/home.jsp"/>
 <property name="unauthorizedUrl" value="/unauthorized.jsp"/>
 <property name="filterChainDefinitions">
  <value>
   /admin/** = authc, roles[admin]
   /logout = logout
   # 其它地址都要求用戶已經(jīng)登錄了
   /** = authc,logger
  </value>
 </property>
</bean>
<bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
 <property name="realm" ref="realm"/>
</bean>
<bean id="lifecycleBeanPostProcessor" class="org.apache.shiro.spring.LifecycleBeanPostProcessor"/>

<!-- 簡(jiǎn)單起見，這里就使用基于文本的Realm實(shí)現(xiàn) -->
<bean id="realm" class="org.apache.shiro.realm.text.TextConfigurationRealm">
 <property name="userDefinitions">
  <value>
   user1=pass1,role1,role2
   user2=pass2,role2,role3
   admin=admin,admin
  </value>
 </property>
</bean>

<bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
 <property name="securityManager" ref="securityManager"/>
 <property name="loginUrl" value="/login.jsp"/>
 <property name="successUrl" value="/home.jsp"/>
 <property name="unauthorizedUrl" value="/unauthorized.jsp"/>
 <property name="filters">
  <util:map>
   <entry key="logger">
    <bean class="com.elim.chat.shiro.filter.LoggerFilter"/>
   </entry>
  </util:map>
 </property>
 <property name="filterChainDefinitions">
  <value>
   /admin/** = authc, roles[admin]
   /logout = logout
   # 其它地址都要求用戶已經(jīng)登錄了
   /** = authc,logger
  </value>
 </property>
</bean>

<bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
 <property name="securityManager" ref="securityManager"/>
 <property name="loginUrl" value="/login.jsp"/>
 <property name="successUrl" value="/home.jsp"/>
 <property name="unauthorizedUrl" value="/unauthorized.jsp"/>
 <property name="filterChainDefinitions">
  <value>
   /admin/** = authc, roles[admin]
   /logout = logout
   # 其它地址都要求用戶已經(jīng)登錄了
   /** = authc,logger
  </value>
 </property>
</bean>
<bean id="logger" class="com.elim.chat.shiro.filter.LoggerFilter"/>

<bean class="org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator" 
 depends-on="lifecycleBeanPostProcessor"/>
<bean class="org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor">
 <property name="securityManager" ref="securityManager"/>
</bean>

<bean id="realm" class="org.apache.shiro.realm.text.TextConfigurationRealm">
 <property name="userDefinitions">
  <value>
   user1=pass1,role1,role2
   user2=pass2,role2,role3
   admin=admin,admin
  </value>
 </property>
 <property name="roleDefinitions">
  <value>
   role1=perm1,perm2
   role2=perm1,perm3
   role3=perm3,perm4
  </value>
 </property>
</bean>

@RequestMapping("/perm1")
@RequiresPermissions("perm1")
public Object permission1() {
 return "permission1";
}

@RequestMapping("/perm1AndPerm4")
@RequiresPermissions({"perm1", "perm4"})
public Object perm1AndPerm4() {
 return "perm1AndPerm4";
}

@RequestMapping("/perm1OrPerm4")
@RequiresPermissions(value={"perm1", "perm4"}, logical=Logical.OR)
public Object perm1OrPerm4() {
 return "perm1OrPerm4";
}

@RestController
@RequestMapping("/foo")
@RequiresPermissions("perm2")
public class FooController {
 @RequestMapping(method=RequestMethod.GET)
 public Object index() {
  Map<String, Object> map = new HashMap<>();
  map.put("abc", 123);
  return map;
 }
}

@RestController
@RequestMapping("/foo")
@RequiresPermissions("perm2")
public class FooController {
 @RequestMapping(method=RequestMethod.GET)
 @RequiresPermissions("perm3")
 public Object index() {
  Map<String, Object> map = new HashMap<>();
  map.put("abc", 123);
  return map;
 }
}

@RestController
@RequestMapping("/foo")
@RequiresPermissions("perm2")
@RequiresRoles("role1")
public class FooController {
 @RequestMapping(method=RequestMethod.GET)
 @RequiresPermissions("perm3")
 public Object index() {
  Map<String, Object> map = new HashMap<>();
  map.put("abc", 123);
  return map;
 }
}

<bean class="org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor">
 <property name="securityManager" ref="securityManager"/>
</bean>

public class AuthorizationAttributeSourceAdvisor extends StaticMethodMatcherPointcutAdvisor {
 private static final Logger log = LoggerFactory.getLogger(AuthorizationAttributeSourceAdvisor.class);
 private static final Class<? extends Annotation>[] AUTHZ_ANNOTATION_CLASSES =
   new Class[] {
     RequiresPermissions.class, RequiresRoles.class,
     RequiresUser.class, RequiresGuest.class, RequiresAuthentication.class
   };
 protected SecurityManager securityManager = null;
 public AuthorizationAttributeSourceAdvisor() {
  setAdvice(new AopAllianceAnnotationsAuthorizingMethodInterceptor());
 }
 public SecurityManager getSecurityManager() {
  return securityManager;
 }
 public void setSecurityManager(org.apache.shiro.mgt.SecurityManager securityManager) {
  this.securityManager = securityManager;
 }
 public boolean matches(Method method, Class targetClass) {
  Method m = method;
  if ( isAuthzAnnotationPresent(m) ) {
   return true;
  }
  //The 'method' parameter could be from an interface that doesn't have the annotation.
  //Check to see if the implementation has it.
  if ( targetClass != null) {
   try {
    m = targetClass.getMethod(m.getName(), m.getParameterTypes());
    return isAuthzAnnotationPresent(m) || isAuthzAnnotationPresent(targetClass);
   } catch (NoSuchMethodException ignored) {
    //default return value is false. If we can't find the method, then obviously
    //there is no annotation, so just use the default return value.
   }
  }
  return false;
 }
 private boolean isAuthzAnnotationPresent(Class<?> targetClazz) {
  for( Class<? extends Annotation> annClass : AUTHZ_ANNOTATION_CLASSES ) {
   Annotation a = AnnotationUtils.findAnnotation(targetClazz, annClass);
   if ( a != null ) {
    return true;
   }
  }
  return false;
 }
 private boolean isAuthzAnnotationPresent(Method method) {
  for( Class<? extends Annotation> annClass : AUTHZ_ANNOTATION_CLASSES ) {
   Annotation a = AnnotationUtils.findAnnotation(method, annClass);
   if ( a != null ) {
    return true;
   }
  }
  return false;
 }
}

public class AopAllianceAnnotationsAuthorizingMethodInterceptor
  extends AnnotationsAuthorizingMethodInterceptor implements MethodInterceptor {
 public AopAllianceAnnotationsAuthorizingMethodInterceptor() {
  List<AuthorizingAnnotationMethodInterceptor> interceptors =
    new ArrayList<AuthorizingAnnotationMethodInterceptor>(5);
  //use a Spring-specific Annotation resolver - Spring's AnnotationUtils is nicer than the
  //raw JDK resolution process.
  AnnotationResolver resolver = new SpringAnnotationResolver();
  //we can re-use the same resolver instance - it does not retain state:
  interceptors.add(new RoleAnnotationMethodInterceptor(resolver));
  interceptors.add(new PermissionAnnotationMethodInterceptor(resolver));
  interceptors.add(new AuthenticatedAnnotationMethodInterceptor(resolver));
  interceptors.add(new UserAnnotationMethodInterceptor(resolver));
  interceptors.add(new GuestAnnotationMethodInterceptor(resolver));
  setMethodInterceptors(interceptors);
 }
 protected org.apache.shiro.aop.MethodInvocation createMethodInvocation(Object implSpecificMethodInvocation) {
  final MethodInvocation mi = (MethodInvocation) implSpecificMethodInvocation;
  return new org.apache.shiro.aop.MethodInvocation() {
   public Method getMethod() {
    return mi.getMethod();
   }
   public Object[] getArguments() {
    return mi.getArguments();
   }
   public String toString() {
    return "Method invocation [" + mi.getMethod() + "]";
   }
   public Object proceed() throws Throwable {
    return mi.proceed();
   }
   public Object getThis() {
    return mi.getThis();
   }
  };
 }
 protected Object continueInvocation(Object aopAllianceMethodInvocation) throws Throwable {
  MethodInvocation mi = (MethodInvocation) aopAllianceMethodInvocation;
  return mi.proceed();
 }
 public Object invoke(MethodInvocation methodInvocation) throws Throwable {
  org.apache.shiro.aop.MethodInvocation mi = createMethodInvocation(methodInvocation);
  return super.invoke(mi);
 }
}

protected void assertAuthorized(MethodInvocation methodInvocation) throws AuthorizationException {
 //default implementation just ensures no deny votes are cast:
 Collection<AuthorizingAnnotationMethodInterceptor> aamis = getMethodInterceptors();
 if (aamis != null && !aamis.isEmpty()) {
  for (AuthorizingAnnotationMethodInterceptor aami : aamis) {
   if (aami.supports(methodInvocation)) {
    aami.assertAuthorized(methodInvocation);
   }
  }
 }
}

public class PermissionAnnotationMethodInterceptor extends AuthorizingAnnotationMethodInterceptor {
 public PermissionAnnotationMethodInterceptor() {
  super( new PermissionAnnotationHandler() );
 }
 public PermissionAnnotationMethodInterceptor(AnnotationResolver resolver) {
  super( new PermissionAnnotationHandler(), resolver);
 }
}

public class PermissionAnnotationHandler extends AuthorizingAnnotationHandler {
 public PermissionAnnotationHandler() {
  super(RequiresPermissions.class);
 }
 protected String[] getAnnotationValue(Annotation a) {
  RequiresPermissions rpAnnotation = (RequiresPermissions) a;
  return rpAnnotation.value();
 }
 public void assertAuthorized(Annotation a) throws AuthorizationException {
  if (!(a instanceof RequiresPermissions)) return;
  RequiresPermissions rpAnnotation = (RequiresPermissions) a;
  String[] perms = getAnnotationValue(a);
  Subject subject = getSubject();
  if (perms.length == 1) {
   subject.checkPermission(perms[0]);
   return;
  }
  if (Logical.AND.equals(rpAnnotation.logical())) {
   getSubject().checkPermissions(perms);
   return;
  }
  if (Logical.OR.equals(rpAnnotation.logical())) {
   // Avoid processing exceptions unnecessarily - "delay" throwing the exception by calling hasRole first
   boolean hasAtLeastOnePermission = false;
   for (String permission : perms) if (getSubject().isPermitted(permission)) hasAtLeastOnePermission = true;
   // Cause the exception if none of the role match, note that the exception message will be a bit misleading
   if (!hasAtLeastOnePermission) getSubject().checkPermission(perms[0]);
  }
 }
}

public void assertAuthorized(MethodInvocation mi) throws AuthorizationException {
 try {
  ((AuthorizingAnnotationHandler)getHandler()).assertAuthorized(getAnnotation(mi));
 }
 catch(AuthorizationException ae) {
  if (ae.getCause() == null) ae.initCause(new AuthorizationException("Not authorized to invoke method: " + mi.getMethod()));
  throw ae;
 }   
}

public class SpringAnnotationResolver implements AnnotationResolver {
 public Annotation getAnnotation(MethodInvocation mi, Class<? extends Annotation> clazz) {
  Method m = mi.getMethod();
  Annotation a = AnnotationUtils.findAnnotation(m, clazz);
  if (a != null) return a;
  //The MethodInvocation's method object could be a method defined in an interface.
  //However, if the annotation existed in the interface's implementation (and not
  //the interface itself), it won't be on the above method object. Instead, we need to
  //acquire the method representation from the targetClass and check directly on the
  //implementation itself:
  Class<?> targetClass = mi.getThis().getClass();
  m = ClassUtils.getMostSpecificMethod(m, targetClass);
  a = AnnotationUtils.findAnnotation(m, clazz);
  if (a != null) return a;
  // See if the class has the same annotation
  return AnnotationUtils.findAnnotation(mi.getThis().getClass(), clazz);
 }
}

public interface RealService {
 Object query(int type);
 
}

@RequestMapping("/service/{type}")
public Object query(@PathVariable("type") int type) {
 return this.realService.query(type);
}

@RequestMapping("/service/{type}")
public Object query(@PathVariable("type") int type) {
 SecurityUtils.getSubject().checkPermission("query:" + type);
 return this.realService.query(type);
}

@RequestMapping("/service/1")
@RequiresPermissions("query:1")
public Object service1() {
 return this.realService.query(1);
}
@RequiresPermissions("query:2")
@RequestMapping("/service/2")
public Object service2() {
 return this.realService.query(2);
}
//...
@RequestMapping("/service/200")
@RequiresPermissions("query:200")
public Object service200() {
 return this.realService.query(200);
}

public class SelfPermissionAnnotationMethodInterceptor extends PermissionAnnotationMethodInterceptor {
 private final SpelExpressionParser parser = new SpelExpressionParser();
 private final ParameterNameDiscoverer paramNameDiscoverer = new DefaultParameterNameDiscoverer();
 private final TemplateParserContext templateParserContext = new TemplateParserContext();
 public SelfPermissionAnnotationMethodInterceptor(AnnotationResolver resolver) {
  super(resolver);
 }
 @Override
 public void assertAuthorized(MethodInvocation mi) throws AuthorizationException {
  Annotation annotation = super.getAnnotation(mi);
  RequiresPermissions permAnnotation = (RequiresPermissions) annotation;
  String[] perms = permAnnotation.value();
  EvaluationContext evaluationContext = new MethodBasedEvaluationContext(null, mi.getMethod(), mi.getArguments(), paramNameDiscoverer);
  for (int i=0; i<perms.length; i++) {
   Expression expression = this.parser.parseExpression(perms[i], templateParserContext);
   //使用Spring EL表達(dá)式解析后的權(quán)限定義替換原來(lái)的權(quán)限定義
   perms[i] = expression.getValue(evaluationContext, String.class);
  }
  Subject subject = getSubject();
  if (perms.length == 1) {
   subject.checkPermission(perms[0]);
   return;
  }
  if (Logical.AND.equals(permAnnotation.logical())) {
   getSubject().checkPermissions(perms);
   return;
  }
  if (Logical.OR.equals(permAnnotation.logical())) {
   // Avoid processing exceptions unnecessarily - "delay" throwing the exception by calling hasRole first
   boolean hasAtLeastOnePermission = false;
   for (String permission : perms) if (getSubject().isPermitted(permission)) hasAtLeastOnePermission = true;
   // Cause the exception if none of the role match, note that the exception message will be a bit misleading
   if (!hasAtLeastOnePermission) getSubject().checkPermission(perms[0]);
  }
 }
}

<bean class="org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor">
 <property name="securityManager" ref="securityManager"/>
 <property name="advice">
  <bean class="org.apache.shiro.spring.security.interceptor.AopAllianceAnnotationsAuthorizingMethodInterceptor">
   <property name="methodInterceptors">
    <util:list>
     <bean class="org.apache.shiro.authz.aop.RoleAnnotationMethodInterceptor"
      c:resolver-ref="springAnnotationResolver"/>
     <!-- 使用自定義的PermissionAnnotationMethodInterceptor -->
     <bean class="com.elim.chat.shiro.SelfPermissionAnnotationMethodInterceptor"
      c:resolver-ref="springAnnotationResolver"/>
     <bean class="org.apache.shiro.authz.aop.AuthenticatedAnnotationMethodInterceptor"
      c:resolver-ref="springAnnotationResolver"/>
     <bean class="org.apache.shiro.authz.aop.UserAnnotationMethodInterceptor"
      c:resolver-ref="springAnnotationResolver"/>
     <bean class="org.apache.shiro.authz.aop.GuestAnnotationMethodInterceptor"
      c:resolver-ref="springAnnotationResolver"/>
    </util:list>
   </property>
  </bean>
 </property>
</bean>

<bean id="springAnnotationResolver" class="org.apache.shiro.spring.aop.SpringAnnotationResolver"/>

<bean id="realm" class="org.apache.shiro.realm.text.TextConfigurationRealm">
 <property name="userDefinitions">
  <value>
   user1=pass1,role1,role2
   user2=pass2,role2,role3
   admin=admin,admin
  </value>
 </property>
 <property name="roleDefinitions">
  <value>
   role1=perm1,perm2,query:1
   role2=perm1,perm3,query:2
   role3=perm3,perm4,query:3
  </value>
 </property>
</bean>

@RequestMapping("/service/{type}")
@RequiresPermissions("query:#{#type}")
public Object query(@PathVariable("type") int type) {
 return this.realService.query(type);
}