Shiro學習，這一篇就夠了

權限認證主要步驟：實現本身的MyRealm（繼承AuthorizingRealm），重寫認證方法：doGetAuthenticationInfo和受權方法：doGetAuthorizationInfo；

doGetAuthenticationInfo示例： 

@Override
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
        System.out.println("token.getPrincipal:" + token.getPrincipal());
        System.out.println("token.getCredentials:" + token.getCredentials());
        String userName = token.getPrincipal().toString();
        User user = userDao.getUserByUserName(userName);
        if (user != null) {
            // Object principal, Object credentials, String realmName
            AuthenticationInfo authcInfo = new SimpleAuthenticationInfo(user.getUserName(), user.getPassword(), getName());
            return authcInfo;
        } else {
            return null;
        }
    }

doGetAuthorizationInfo示例：

 @Override
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken) throws AuthenticationException {
        String userName = (String) authenticationToken.getPrincipal();
        if ("".equals(userName)) {
            return  null;
        }
        SimpleAuthenticationInfo info = new SimpleAuthenticationInfo(userName,"123456",this.getName());
        return info;
    }

doGetAuthorizationInfo這裏是簡單示例，其實就是把用戶的信息放進去，例如用戶的角色list，權限list；

後臺權限控制：

@RequiresPermissions({"delete"}) //須要有delete權限；沒有的話 AuthorizationException
    @PostMapping("/delete")
    public Map<String, Object> deletePermission() {
        System.out.println("delete");
        Map<String, Object> map = new HashMap<String, Object>();
        map.put("success", true);
        map.put("msg", "當前角色有刪除的權力");
        return map;
    }

    @RequiresRoles({"vip"}) //須要有vip角色，沒有的話 AuthorizationException
    @PostMapping("/vip")
    public Map<String, Object> vipRole() {
        System.out.println("vip");
        Map<String, Object> map = new HashMap<String, Object>();
        map.put("success", true);
        map.put("msg", "當前用戶具備 vip 角色");
        return map;
    }

固然還須要配置shiro，好比shiroFilter，配置哪些路徑須要認證，哪些無需認證（好比登入登出）：其餘具體細節可訪問最下面的連接；

注：① authc:全部url都必須認證經過才能夠訪問; ② anon:全部url都均可以匿名訪問

參考文章：  https://blog.csdn.net/larger5/article/details/79838212（@Configuration配置類方式配置）

shiroFilter配置詳解： https://blog.csdn.net/zhangcc233/article/details/80591769