匯入shiro框架的jar包和ehcache的jar包。

src/ehcache.xml（ehcache的配置檔案）：

<ehcache xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="../config/ehcache.xsd">
    <diskStore path="java.io.tmpdir"/>
    <defaultCache
            maxElementsInMemory="10000"
            eternal="false"
            timeToIdleSeconds="120"
            timeToLiveSeconds="120"
            overflowToDisk="true"
            maxElementsOnDisk="10000000"
            diskPersistent="false"
            diskExpiryThreadIntervalSeconds="120"
            memoryStoreEvictionPolicy="LRU"
            />
</ehcache>
 

src/applicationContext.xml（Spring配置檔案，註冊ehcache快取管理器並注入shiro安全管理器）：

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
	xmlns:context="http://www.springframework.org/schema/context"
	xmlns:aop="http://www.springframework.org/schema/aop"
	xmlns:tx="http://www.springframework.org/schema/tx"
	xmlns:jaxws="http://cxf.apache.org/jaxws"
	xmlns:soap="http://cxf.apache.org/bindings/soap"
	xsi:schemaLocation="http://www.springframework.org/schema/beans 
						http://www.springframework.org/schema/beans/spring-beans.xsd
						http://www.springframework.org/schema/context
						http://www.springframework.org/schema/context/spring-context.xsd
						http://www.springframework.org/schema/aop
						http://www.springframework.org/schema/aop/spring-aop.xsd
						http://www.springframework.org/schema/tx 
						http://www.springframework.org/schema/tx/spring-tx.xsd
						http://cxf.apache.org/bindings/soap 
						http://cxf.apache.org/schemas/configuration/soap.xsd
						http://cxf.apache.org/jaxws 
						http://cxf.apache.org/schemas/jaxws.xsd
						">
		
		
	<!-- 配置shiro框架的過濾器工廠物件。"shiroFilter"要和web.xml中配置的過濾器名保持相同 -->
	<bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
		<!-- 注入安全管理器物件 -->
		<property name="securityManager" ref="securityManager"/>
		<!-- 注入訪問相關頁面的URL -->
		<property name="loginUrl" value="/login.jsp"/>
		<property name="successUrl" value="/index.jsp"/>
		<property name="unauthorizedUrl" value="/unauthorized.jsp"/>  <!-- 許可權不足的錯誤提示頁 -->
		<!--注入URL攔截規則 -->
		<property name="filterChainDefinitions">
			<value>
				/css/** = anon   <!-- anon是過濾器的別名(簡稱)。 兩個*表示遞迴所有層子目錄 -->
				/js/** = anon    <!-- 過濾器有次序之分,依次匹配過濾器 -->
				/images/** = anon
				/validatecode.jsp* = anon
				/login.jsp = anon
				/userAction_login.action = anon
				/page_base_staff.action = perms["staff-list"]  <!-- 必須先認證(登入)後,才會進行授權(許可權分配)。"staff-list"是自定義的許可權名 -->
				/* = authc    <!-- authc表示是否已認證(已登入) -->
			</value>
		</property>
	</bean>
	
	<!-- 註冊shiro安全管理器物件 -->
	<bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
		<property name="realm" ref="bosRealm"/>
		<!-- 注入ehcache快取管理器 -->
		<property name="cacheManager" ref="cacheManager"/>
	</bean>
	
	<!-- 註冊ehcache快取管理器 -->
	<bean id="cacheManager" class="org.apache.shiro.cache.ehcache.EhCacheManager">
		<!-- 注入ehcache的配置檔案 -->
		<property name="cacheManagerConfigFile" value="classpath:ehcache.xml"/>
	</bean>
	
	<!-- 註冊realm -->
	<bean id="bosRealm" class="com.xxx.bos.realm.BOSRealm">
	</bean>
	
	<!-- 開啟shiro框架註解支援 -->
	<bean id="defaultAdvisorAutoProxyCreator" 
		class="org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator">
			<!-- 必須使用cglib方式為Action物件建立代理物件 -->
		<property name="proxyTargetClass" value="true"/>
	</bean>
	
	<!-- 配置shiro框架提供的切面類，用於建立代理物件 -->
	<bean class="org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor"/>
</beans>