1.导入依赖

<dependency>
            <groupId>io.springfox</groupId>
            <artifactId>springfox-boot-starter</artifactId>
            <version>3.0.0</version>
        </dependency>

2.编写shrio配置类

@Configuration
public class ShiroConfig { 
    //创建shiroFilter，处理所有shiro的请求
    @Bean
    public ShiroFilterFactoryBean getShiroFilterFactoryBean(DefaultWebSecurityManager defaultWebSecurityManager){ 
        //创建shiro的filter
        ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();
        //注入安全管理器
        shiroFilterFactoryBean.setSecurityManager(defaultWebSecurityManager);
        return shiroFilterFactoryBean;
    }
    @Bean
    public DefaultWebSecurityManager getSecurityManager(Realm realm){ 
        DefaultWebSecurityManager defaultWebSecurityManager = new DefaultWebSecurityManager();
        defaultWebSecurityManager.setRealm(realm);
        return defaultWebSecurityManager;
    }
    @Bean
    public Realm getRealm(){ 
        return new UserRealm();//UserRealm是自己编写的自定义realm，realm中完成shiro授权和认证的编写
    }
}

3.编写自定义realm

public class UserRealm extends AuthorizingRealm { 
    @Autowired
    UserMapper userMapper;
    //授权操作的实现
    @Override
    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) { 
        //获取用户信息，主要是指的用户名
        String primaryPrincipal = (String) principalCollection.getPrimaryPrincipal();
        //根据用户名去查询用户的角色，这里我封装了一个工具类可以完成根据用户名去查询用户的角色的功能，并返回角色字符串
        String roleByUserName = GetRoleByUserNameUtil.getRoleByUserName(primaryPrincipal);
        //声明一个查SimpleAuthorizationInfo对象
        SimpleAuthorizationInfo simpleAuthorizationInfo = new SimpleAuthorizationInfo();
        //通过SimpleAuthorizationInfo对象给用户添加角色
        simpleAuthorizationInfo.addRole(roleByUserName);
        return simpleAuthorizationInfo;
// return null;
    }
    //认证操作的实现
    @Override
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken) throws AuthenticationException { 
        String principal = (String) authenticationToken.getPrincipal();
        QueryWrapper<User> wrapper=new QueryWrapper<>();
        wrapper.eq("userName",principal);
        User user = userMapper.selectOne(wrapper);
        if (null != user){ 
            SimpleAuthenticationInfo simpleAuthenticationInfo =
                    new SimpleAuthenticationInfo(principal,user.getPassword(),this.getName());
            return simpleAuthenticationInfo;
        }
        return null;
    }
}

4.编写测试接口

@RestController
public class TestLogin { 
    @Autowired
    UserService userService;
    //测试认证的接口
        @PostMapping("/user/login")
    public void testLoginAndShiro(User user){ 
        UsernamePasswordToken token = new
                UsernamePasswordToken(user.getUserName(), user.getPassword());  //将用户的密码和用户名生成一个token
        Subject subject = SecurityUtils.getSubject();  //通过全局安全工具类来获取用户subject对象
        try { 
            subject.login(token);  //调用subject的login来进行认证，会调用realm的doGetAuthenticationInfo方法
            System.out.println("状态" + subject.isAuthenticated());
        } catch (Exception e) { 
            e.printStackTrace();
        }
    }
    //对授权操作的测试接口
    @RequiresRoles("user")  //该注解要求拥有user这个角色才可以访问
    @GetMapping("/user/uuu")
    public String testAuthorization(){ 
        return "lihai";
    }
}