許可權控制是一個比較重要的知識點。
先講一下相關理論知識，如圖：

每次傳送請求都會呼叫到controller，而controller又會呼叫subject，每個使用者對應一個subject（subject包含了session），且subject會負責和shiro互動，securityManager管理了Realm，而Realm可以進行登入驗證，可以對使用者操作付許可權。
通過SpringBoot做許可權控制的步驟如下：
1、首先要引入相應的包。
除了要引入其他基本功能的包，還要引入和許可權控制相關的包，pom程式碼如下：

<dependency>
    <groupId
 
>org.apache.shiro</groupId>
    <artifactId>shiro-core</artifactId>
    <version>1.2.0</version>
</dependency>
<dependency>
    <groupId>org.apache.shiro</groupId>
    <artifactId>shiro-web</artifactId>
    <version>1.2.0</version>
 

</dependency>
<dependency>
    <groupId>org.apache.shiro</groupId>
    <artifactId>shiro-ehcache</artifactId>
    <version>1.2.0</version>
</dependency>
<dependency>
    <groupId>org.apache.shiro</groupId>
    <artifactId>shiro-spring</artifactId
 
>
    <version>1.2.0</version>
</dependency>

2、自定義Realm 繼承自AuthorizingRealm:

package com.mySpringBoot.shiro;

import java.util.ArrayList;
import java.util.List;
import java.util.Set;

import org.apache.shiro.authc.AuthenticationException;
import org.apache.shiro.authc.AuthenticationInfo;
import org.apache.shiro.authc.AuthenticationToken;
import org.apache.shiro.authc.SimpleAuthenticationInfo;
import org.apache.shiro.authc.UsernamePasswordToken;
import org.apache.shiro.authz.AuthorizationInfo;
import org.apache.shiro.authz.SimpleAuthorizationInfo;
import org.apache.shiro.realm.AuthorizingRealm;
import org.apache.shiro.subject.PrincipalCollection;
import org.springframework.beans.factory.annotation.Autowired;

import com.mySpringBoot.bean.Module;
import com.mySpringBoot.bean.Role;
import com.mySpringBoot.bean.User;
import com.mySpringBoot.service.UserService;

/** 
 * @Description AuthRealm完成根據使用者名稱去資料庫的查詢,並且將使用者資訊放入shiro中,供第二個類呼叫.CredentialsMatcher,完成對於密碼的校驗.其中使用者的資訊來自shiro 
 * @ClassName   AuthRealm 
 * @Date        2017年8月30日 下午9:05:03 
 * @Author      動腦學院-jack
 */
public class AuthRealm extends AuthorizingRealm {
    @Autowired
    private UserService service;

    //認證.登入
    /* 
     *這個方法主要是做登入驗證，說白了就是去資料庫裡面校驗使用者是否存在，注意這裡不需要進行祕密校驗，shiro會幫我們做密碼校驗
     */
    @Override
    protected AuthenticationInfo doGetAuthenticationInfo(
            AuthenticationToken token) throws AuthenticationException {
        try {
            UsernamePasswordToken utoken = (UsernamePasswordToken)token;//獲取使用者輸入的token
            String username = utoken.getUsername();
            User user = service.findUserByName(username);
            if (user != null) {
                // 若存在，將此使用者存放到登入認證info中，無需自己做密碼對比，Shiro會為我們進行密碼對比校驗
                return new SimpleAuthenticationInfo(user, user.getPassword(),
                        this.getClass().getName());//放入shiro.呼叫CredentialsMatcher檢驗密碼
            }
        }
        catch (Exception e) {
            e.printStackTrace();
        }
        return null;
    }

    //授權
    /* 
     * 授權的方法是在碰到<shiro:hasPermission>標籤的時候呼叫的,它會去檢測shiro框架中的許可權(這裡的permissions)是否包含有該標籤的name值,如果有,裡面的內容顯示,如果沒有,裡面的內容不予顯示(這就完成了對於許可權的認證.)
     */
    @Override
    protected AuthorizationInfo doGetAuthorizationInfo(
            PrincipalCollection principal) {
        User user = (User)principal.fromRealm(this.getClass().getName())
                .iterator()
                .next();//獲取session中的使用者
        List<String> permissions = new ArrayList<String>();
        Set<Role> roles = user.getRoles();
        if (roles.size() > 0) {
            for (Role role : roles) {
                Set<Module> modules = role.getModules();
                if (modules.size() > 0) {
                    for (Module module : modules) {
                        permissions.add(module.getMname());
                    }
                }
            }
        }
        SimpleAuthorizationInfo info = new SimpleAuthorizationInfo();
        info.addStringPermissions(permissions);//將許可權放入shiro中.
        return info;
    }
}

3、密碼校驗器：

package com.mySpringBoot.shiro;

import org.apache.shiro.authc.AuthenticationInfo;
import org.apache.shiro.authc.AuthenticationToken;
import org.apache.shiro.authc.UsernamePasswordToken;
import org.apache.shiro.authc.credential.SimpleCredentialsMatcher;

/** 
 * @Description 這個類進行祕密的校驗 
 * @ClassName   CredentialsMatcher 
 * @Date        2017年8月30日 下午9:17:29 
 * @Author      動腦學院-jack
 */
public class CredentialsMatcher extends SimpleCredentialsMatcher {

    @Override
    public boolean doCredentialsMatch(AuthenticationToken token,
            AuthenticationInfo info) {
        UsernamePasswordToken utoken = (UsernamePasswordToken)token;
        //獲得使用者輸入的密碼
        String inPassword = new String(utoken.getPassword());
        //獲得資料庫中的密碼
        String dbPassword = (String)info.getCredentials();
        //進行密碼的比對
        return this.equals(inPassword, dbPassword);
    }
}

4、新建許可權管理類：
這一步首先需要定義一個方法返回ShiroFilterFactoryBean，ShiroFilterFactoryBean物件要設定登入的URL，設定哪些路徑是可以匿名訪問，哪些是需要許可權訪問的。

@Bean(name = "shiroFilter")
    public ShiroFilterFactoryBean shiroFilter(
            @Qualifier("securityManager") SecurityManager manager) {
        ShiroFilterFactoryBean bean = new ShiroFilterFactoryBean();
        bean.setSecurityManager(manager);
        //配置登入的url和登入成功的url
        bean.setLoginUrl("/login");
        bean.setSuccessUrl("/home");
        //配置訪問許可權
        LinkedHashMap<String, String> filterChainDefinitionMap = new LinkedHashMap<>();
        filterChainDefinitionMap.put("/jsp/login.jsp*", "anon"); //表示可以匿名訪問,anon表示不需要攔截
        filterChainDefinitionMap.put("/loginUser", "anon");
        filterChainDefinitionMap.put("/logout*", "anon");
        filterChainDefinitionMap.put("/jsp/error.jsp*", "anon");
        filterChainDefinitionMap.put("/jsp/index.jsp*", "authc");
        filterChainDefinitionMap.put("/*", "authc");//表示需要認證才可以訪問
        filterChainDefinitionMap.put("/**", "authc");//表示需要認證才可以訪問
        filterChainDefinitionMap.put("/*.*", "authc");
        bean.setFilterChainDefinitionMap(filterChainDefinitionMap);
        return bean;
    }

然後配置核心安全事務管理器，返回SecurityManager物件：

//配置核心安全事務管理器
    @Bean(name = "securityManager")
    public SecurityManager securityManager(
            @Qualifier("authRealm") AuthRealm authRealm) {
        System.err.println("--------------shiro已經載入----------------");
        DefaultWebSecurityManager manager = new DefaultWebSecurityManager();
        manager.setRealm(authRealm);
        return manager;
    }

設定密碼比較器：

//配置自定義的密碼比較器
    @Bean(name = "credentialsMatcher")
    public CredentialsMatcher credentialsMatcher() {
        return new CredentialsMatcher();
    }

配置自定義的許可權登入器：

@Bean(name = "authRealm")
    public AuthRealm authRealm(
            @Qualifier("credentialsMatcher") CredentialsMatcher matcher) {
        AuthRealm authRealm = new AuthRealm();
        authRealm.setCredentialsMatcher(matcher);
        return authRealm;
    }

總體程式碼：

package com.mySpringBoot.shiro;

import java.util.LinkedHashMap;

import org.apache.shiro.mgt.SecurityManager;
import org.apache.shiro.spring.LifecycleBeanPostProcessor;
import org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor;
import org.apache.shiro.spring.web.ShiroFilterFactoryBean;
import org.apache.shiro.web.mgt.DefaultWebSecurityManager;
import org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator;
import org.springframework.beans.factory.annotation.Qualifier;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;

@Configuration
public class ShiroConfiguration {

    @Bean(name = "shiroFilter")
    public ShiroFilterFactoryBean shiroFilter(
            @Qualifier("securityManager") SecurityManager manager) {
        ShiroFilterFactoryBean bean = new ShiroFilterFactoryBean();
        bean.setSecurityManager(manager);
        //配置登入的url和登入成功的url
        bean.setLoginUrl("/login");
        bean.setSuccessUrl("/home");
        //配置訪問許可權
        LinkedHashMap<String, String> filterChainDefinitionMap = new LinkedHashMap<>();
        filterChainDefinitionMap.put("/jsp/login.jsp*", "anon"); //表示可以匿名訪問,anon表示不需要攔截
        filterChainDefinitionMap.put("/loginUser", "anon");
        filterChainDefinitionMap.put("/logout*", "anon");
        filterChainDefinitionMap.put("/jsp/error.jsp*", "anon");
        filterChainDefinitionMap.put("/jsp/index.jsp*", "authc");
        filterChainDefinitionMap.put("/*", "authc");//表示需要認證才可以訪問
        filterChainDefinitionMap.put("/**", "authc");//表示需要認證才可以訪問
        filterChainDefinitionMap.put("/*.*", "authc");
        bean.setFilterChainDefinitionMap(filterChainDefinitionMap);
        return bean;
    }
    //配置核心安全事務管理器
    @Bean(name = "securityManager")
    public SecurityManager securityManager(
            @Qualifier("authRealm") AuthRealm authRealm) {
        System.err.println("--------------shiro已經載入----------------");
        DefaultWebSecurityManager manager = new DefaultWebSecurityManager();
        manager.setRealm(authRealm);
        return manager;
    }

    //配置自定義的許可權登入器
    @Bean(name = "authRealm")
    public AuthRealm authRealm(
            @Qualifier("credentialsMatcher") CredentialsMatcher matcher) {
        AuthRealm authRealm = new AuthRealm();
        authRealm.setCredentialsMatcher(matcher);
        return authRealm;
    }

    //配置自定義的密碼比較器
    @Bean(name = "credentialsMatcher")
    public CredentialsMatcher credentialsMatcher() {
        return new CredentialsMatcher();
    }

    @Bean
    public LifecycleBeanPostProcessor lifecycleBeanPostProcessor() {
        return new LifecycleBeanPostProcessor();
    }

    @Bean
    public DefaultAdvisorAutoProxyCreator defaultAdvisorAutoProxyCreator() {
        DefaultAdvisorAutoProxyCreator creator = new DefaultAdvisorAutoProxyCreator();
        creator.setProxyTargetClass(true);
        //        creator.setOrder(1);
        return creator;
    }

    @Bean
    public AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor(
            @Qualifier("securityManager") SecurityManager manager) {
        AuthorizationAttributeSourceAdvisor advisor = new AuthorizationAttributeSourceAdvisor();
        advisor.setSecurityManager(manager);
        //        advisor.setOrder(0);
        return advisor;
    }
}