1、自定義令牌：定義一個類，繼承自：UsernamePasswordToken

public class MyToken extend  UsernamePasswordToken

2、登陸操作：

Subject currentUser = SecurityUtils.getSubject();
currentUser.login(MyToken);

3、自定義密碼憑證：定義一個類，繼承自：AuthorizingRealm

public class UserRealm extends AuthorizingRealm

4、自定義授權操作（登陸之後），在自定義密碼憑證裡面重寫doGetAuthorizationInfo方法

    /**
     * 授權(驗證許可權時呼叫)
     */
    @Override
    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {
        LoginUser loginUser = (LoginUser) principals.getPrimaryPrincipal();
        int roleId = loginUser.getRoleId();
        String userType = loginUser.getUserType();
        //使用者許可權列表
        Set<String> permsSet = permissionBizService.getPermissionByRoleId(roleId, userType);
        SimpleAuthorizationInfo info = new SimpleAuthorizationInfo();
        info.setStringPermissions(permsSet);
        return info;
    }
 

  5、自定義認證操作（登陸時候呼叫），在自定義密碼憑證裡面重寫doGetAuthenticationInfo

/**
     * 認證(登入時呼叫)
     */
    @Override
    protected AuthenticationInfo doGetAuthenticationInfo(
            AuthenticationToken token) {
        MyToken myToken = (MyToken ) token;
        String username = (String) myToken.getPrincipal();
        String password = new String((char[]) myToken.getCredentials());
        String userType = myToken.getUserType();
        LoginUser loginUser = userBizService.getUserByMobile(username, userType);
        if (loginUser == null) {
            //沒找到帳號
            throw new UnknownAccountException();
        }
            //交給AuthenticatingRealm使用CredentialsMatcher進行密碼匹配
        SimpleAuthenticationInfo authenticationInfo = new SimpleAuthenticationInfo(loginUser, loginUser.getPassword(), getName());
        //session中不需要儲存密碼
        loginUser.setPassword(null);
        //將使用者資訊放入session中
        Session session = SecurityUtils.getSubject().getSession();
        session.setAttribute(Constants.SESSION_USER, loginUser);
        return authenticationInfo;
    }
 

6、使用自定義密碼校驗（在自定義認證操作方法裡面呼叫），在自定義密碼憑證裡面初始化initCredentialsMatcher方法

    @PostConstruct
    public void initCredentialsMatcher() {
        //該句作用是重寫shiro的密碼驗證，讓shiro用我自己的驗證
        setCredentialsMatcher(new CustomCredentialsMatcher());
    }

7、自定義密碼校驗：定義一個類，繼承自SimpleCredentialsMatcher

/**
 * 自定義密碼校驗
 **/
public class CustomCredentialsMatcher extends SimpleCredentialsMatcher {

    @Override
    public boolean doCredentialsMatch(AuthenticationToken authcToken, AuthenticationInfo info) {
        UsernamePasswordToken token = (UsernamePasswordToken) authcToken;
        Object tokenCredentials = String.valueOf(token.getPassword());
        Object accountCredentials = getCredentials(info);
        MyToken myToken = (MyToken) token;
        String loginType = myToken.getLoginType();
        //將密碼加密與系統加密後的密碼校驗，內容一致就返回true,不一致就返回false
        try {
            if (loginType.equals("0")){//使用使用者名稱+密碼登陸
                return PasswordHash.validatePassword(tokenCredentials.toString(), accountCredentials.toString());
            }else{//使用手機驗證碼登陸
                return true;
            }
        } catch (Exception e) {
            throw new ServiceException("密碼錯誤！");
        }
    }
}