通过注解配置授权

• 依赖

 <dependency>
    <groupId>org.aspectj</groupId>
    <artifactId>aspectjweaver</artifactId>
    <version>1.8.9</version>
 </denpendency>

• spring-mvc.xml

<aop:config proxy-target-class="true" />
<bean class="org.apache.shiro.spring.LifecycleBeanPostProcessor" />
<bean class="org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor">
    <property name="securityManager" ref="securityManger" />
</bean>

• Controller.java

@RequiresRoles("admin")
@RequestMapping(value="/testRole", method = RequestMethod.GET)
@ResponseBody
public String testRole() {
    return "testRole success";
}

@RequiresRoles("admin1")
@RequestMapping(value="/testRole1", method = RequestMethod.GET)
@ResponseBody
public String testRole1() {
    return "testRole1 success";
}

@RequiresPermissions("xxx")