@Controller
//省略具体URL路径代码
//此处直接传入表单，或者JSON也可以，总之要绑定User对象。
public String login(User user, BindingResult result, Model model, HttpServletRequest request) {

try {
            //获取一个Subject，Subject在Shiro框架中是主体，一般场景中就是登陆的用户。
            Subject subject = SecurityUtils.getSubject();
            //如果是已经登录的（Session中有相应会话），跳转到上一个访问的页面
            if (subject.isAuthenticated()) {
                return "redirect:/";
            }
            //如果传入参数不正确，例如密码是空的
            if (result.hasErrors()) {
                model.addAttribute("error", "参数错误！");
                return "login";
            }

//            将表单传入的email和密码存为Shiro的Token
            UsernamePasswordToken token = new UsernamePasswordToken(user.getEmail(), user.getPwd());
			//并且提交Realm验证
            subject.login(token);
			//如果认证通过，没有抛出异常
            final User authUserInfo = um.getUserByEmail(user.getEmail());
            request.getSession().setAttribute("userInfo", authUserInfo);
        } catch (AuthenticationException e) {
            // 身份验证失败
            model.addAttribute("error", "用户名或密码错误 ！");
            return "login";
        }
}

@Override
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
        String email = String.valueOf(token.getPrincipal());
        String password = new String((char[]) token.getCredentials());
	//获取参数，并使用参数在数据库中验证，此处um即为Spring注入的UserMapper
        final User authc = um.getIdPwdByEmail(email);
	//接下来的逻辑可以自由发挥，总之登录失败就要抛出异常，并且由Controller捕捉
        if (password.equals(authc.getPwd())){
            //此处getname是获取该类的名字
            SimpleAuthenticationInfo authenticationInfo = new SimpleAuthenticationInfo(email, password, getName());
            return authenticationInfo;
        }else{
            throw new AuthenticationException("用户名或密码错误.");
        }
    }

protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {
       SimpleAuthorizationInfo authorizationInfo = new SimpleAuthorizationInfo();
       String email = String.valueOf(principals.getPrimaryPrincipal());
       final User user = um.getUserByEmail(email);
       Set set = new HashSet<String>();
       if (user.getAdmin() == 1){
           set.add("Admin");
       }else{
           set.add("User");
       }
       authorizationInfo.setRoles(set);
       return authorizationInfo;
   }

package com.qhs.blog.util.shiro;

import org.apache.shiro.subject.Subject;
import org.apache.shiro.subject.SubjectContext;
import org.apache.shiro.web.mgt.DefaultWebSubjectFactory;

public class StatelessDefaultSubjectFactory extends DefaultWebSubjectFactory {
    public Subject createSubject(SubjectContext context) {
        //不创建session
        context.setSessionCreationEnabled(false);
        return super.createSubject(context);
    }
}

package com.qhs.blog.util.shiro.filter;


import com.qhs.blog.serviceImpl.tokenServiceImpl;
import net.minidev.json.JSONObject;
import org.apache.shiro.web.filter.AccessControlFilter;
import org.apache.shiro.web.util.WebUtils;
import org.springframework.beans.factory.annotation.Autowired;

import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
import java.util.Map;

/**
 * Created by QHS on 2017/5/31.
 */
public class captchaFilter extends AccessControlFilter {
    @Autowired
    private tokenServiceImpl tokenService;

    JSONObject resp = new JSONObject();

    @Override
    protected boolean isAccessAllowed(ServletRequest servletRequest, ServletResponse servletResponse, Object o) throws Exception {
        boolean flag = false;
        HttpServletRequest req = WebUtils.toHttp(servletRequest);
        String token = req.getParameter("token");
        Map<String, Object> resultMap = tokenService.validToken(token);
        switch ((String) resultMap.get("state")) {
            case "EXPIRED":
                resp.put("warning", "授权已过期");
                break;
            case "VALID":
                JSONObject jo = (JSONObject) resultMap.get("data");
                String value = (String) jo.get("value");
                if (value.equals("captchaAuthed") && value.equals("getMailCode")) {
                    flag = true;
                }
                break;
            case "INVALID":
                resp.put("msg", "请输入验证码");
                break;
        }

        return flag;
    }

    @Override
    protected boolean onAccessDenied(ServletRequest servletRequest, ServletResponse servletResponse) throws Exception {

        servletResponse.setCharacterEncoding("UTF-8");
        servletResponse.setContentType("application/json; charset=utf-8");
        servletResponse.getWriter().write(resp.toJSONString());
        return false;
    }

}

public class userRealm extends AuthorizingRealm {
    @Override
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken) throws AuthenticationException {
        return null;
    }
    @Override
    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {
        return null;
    }
}