dependency>
   <groupId>org.apache.shiro</groupId>
   <artifactId>shiro-spring</artifactId>
   <version>1.3.2</version>
</dependency>

@Configuration
public class ShiroConfig {
   @Bean
   public ShiroFilterFactoryBean shirFilter(SecurityManager securityManager) {
       ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();
       // 必须设置 SecurityManager
       shiroFilterFactoryBean.setSecurityManager(securityManager);
       // setLoginUrl 如果不设置值，默认会自动寻找Web工程根目录下的"/login.jsp"页面 或 "/login" 映射
       shiroFilterFactoryBean.setLoginUrl("/notLogin");
       // 设置无权限时跳转的 url;
       shiroFilterFactoryBean.setUnauthorizedUrl("/notRole");
 
       // 设置拦截器
       Map<String, String> filterChainDefinitionMap = new LinkedHashMap<>();
       //游客，开发权限
       filterChainDefinitionMap.put("/guest/**", "anon");
       //用户，需要角色权限 “user”
       filterChainDefinitionMap.put("/user/**", "roles[user]");
       //管理员，需要角色权限 “admin”
       filterChainDefinitionMap.put("/admin/**", "roles[admin]");
       //开放登陆接口
       filterChainDefinitionMap.put("/login", "anon");
       //其余接口一律拦截
       //主要这行代码必须放在所有权限设置的最后，不然会导致所有 url 都被拦截
       filterChainDefinitionMap.put("/**", "authc");
 
       shiroFilterFactoryBean.setFilterChainDefinitionMap(filterChainDefinitionMap);
       System.out.println("Shiro拦截器工厂类注入成功");
       return shiroFilterFactoryBean;
   }
 
   /**
    * 注入 securityManager
    */
   @Bean
   public SecurityManager securityManager() {
       DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager();
       // 设置realm.
       securityManager.setRealm(customRealm());
       return securityManager;
   }
 
   /**
    * 自定义身份认证 realm;
    * <p>
    * 必须写这个类，并加上 @Bean 注解，目的是注入 CustomRealm，
    * 否则会影响 CustomRealm类 中其他类的依赖注入
    */
   @Bean
   public CustomRealm customRealm() {
       return new CustomRealm();
   }
}

@RestController
public class LoginController {
   @Autowired    
   private ResultMap resultMap;
   private UserMapper userMapper;
 
   @RequestMapping(value = "/notLogin", method = RequestMethod.GET)
   public ResultMap notLogin() {
       return resultMap.success().message("您尚未登陆！");
   }
 
   @RequestMapping(value = "/notRole", method = RequestMethod.GET)
   public ResultMap notRole() {
       return resultMap.success().message("您没有权限！");
   }
 
   @RequestMapping(value = "/logout", method = RequestMethod.GET)
   public ResultMap logout() {
       Subject subject = SecurityUtils.getSubject();
       //注销
       subject.logout();
       return resultMap.success().message("成功注销！");
   }
 
   /**
    * 登陆
    *
    * @param username 用户名
    * @param password 密码
    */
   @RequestMapping(value = "/login", method = RequestMethod.POST)
   public ResultMap login(String username, String password) {
       // 从SecurityUtils里边创建一个 subject
       Subject subject = SecurityUtils.getSubject();
       // 在认证提交前准备 token（令牌）
       UsernamePasswordToken token = new UsernamePasswordToken(username, password);
       // 执行认证登陆
       subject.login(token);
       //根据权限，指定返回数据
       String role = userMapper.getRole(username);
       if ("user".equals(role)) {
           return resultMap.success().message("欢迎登陆");
       }
       if ("admin".equals(role)) {
           return resultMap.success().message("欢迎来到管理员页面");
       } 
       return resultMap.fail().message("权限错误！");
   }
}