<bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">

        <property name="securityManager" ref="securityManager"/>

        <!-- 登录页面 ，用户 登录不成功自动 返回该页面 -->

        <property name="loginUrl" value="/login"/>

        <!-- 登录成功页面，登录成功后跳转到该页面  -->

        <property name="successUrl" value="/index"/>

        <!-- 无权访问跳转页面  -->

        <property name="unauthorizedUrl" value="permNo"/>

        <!-- 自定义权限页面设置url的访问权限。anon表示不用验证，

        都可以访问。anthc：authc filter 监听，不登陆不能访问。logout：logout filter监听。

        没有列出的常用配置：perms["remote:invoke"] ：需要角色romote 和权限invoke才能访问。roles["admin"]需要角色admin才能访问。设置可用“,”隔开，

        如：/admin/test = authc,roles[admin]  -->

        <property name="filterChainDefinitions">

            <value>

                <!--  无参,表示需认证才能使用 -->

　　　　　　　　　　/home=authc

                /resources/**=anon

            </value>

        </property>

    </bean>

@RequiresAuthentication

public void updateAccount(Account userAccount) {

//this method will only be invoked by a

//Subject that is guaranteed authenticated

...

}

@RequiresGuest

public void signUp(User newUser) {

//this method will only be invoked by a

//Subject that is unknown/anonymous

...

}

@RequiresPermissions("account:create")

public void createAccount(Account account) {

//this method will only be invoked by a Subject

//that is permitted to create an account

...

}

@RequiresRoles("administrator")

public void deleteUser(User user) {

//this method will only be invoked by an administrator

...

}

bean id="myRealm" class="com.controller.MyRealm"/>

<bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">

        <property name="realm" ref="myRealm"/>

    </bean>

    <!--========================-如果使用注解方式验证将下面代码放开===============================-->

    <!-- 保证实现了Shiro内部lifecycle函数的bean执行 -->

    <bean id="lifecycleBeanPostProcessor" class="org.apache.shiro.spring.LifecycleBeanPostProcessor"/>

    <bean class="org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator" depends-on="lifecycleBeanPostProcessor">

        <property name="proxyTargetClass" value="true" />

    </bean>

    <bean class="org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor">

        <property name="securityManager" ref="securityManager"/>

    </bean>

    <bean class="org.springframework.web.servlet.handler.SimpleMappingExceptionResolver">

        <property name="exceptionMappings">

            <props>

                <!--登录-->

                <prop key="org.apache.shiro.authz.UnauthenticatedException">

                    redirect:/login

                </prop>

                <!--授权-->

                <prop key="org.apache.shiro.authz.UnauthorizedException">

                    redirect:/admin/common/exceptionLog

                </prop>

            </props>

        </property>

        <property name="defaultErrorView" value="error/genericView"/>

    </bean>