1.1步骤一

依赖配置：

<!-- 配置shiro安全框架 -->
<dependency>
    <groupId>org.apache.shiro</groupId>
    <artifactId>shiro-spring</artifactId>
    <version>1.4.0</version>
</dependency>

1.2步骤二

web.xml

<?xml version="1.0" encoding="UTF-8"?>
<web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
       xmlns="http://java.sun.com/xml/ns/javaee"
       xsi:schemaLocation="http://java.sun.com/xml/ns/javaee
       http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd"
       version="3.0">
   <!-- 配置Spring委派过滤器代理(要求Spring容器中有了个bean的id为shiroFilter) -->
    <filter>
      <filter-name>shiroFilter</filter-name>
      <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
   </filter>
   <filter-mapping>
      <filter-name>shiroFilter</filter-name>
      <url-pattern>/*</url-pattern>
   </filter-mapping>
</web-app>

1.3步骤三

applicationContext-shiro.xml

<?xml version="1.0" encoding="utf-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
       xsi:schemaLocation="http://www.springframework.org/schema/beans
       http://www.springframework.org/schema/beans/spring-beans.xsd">
    <!-- 1. 配置shiro作为Spring委派过滤器(shiro过滤器工厂) -->
    <bean id="shiroFilter"  
class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
        <!-- 配置安全管理对象 -->
        <property name="securityManager" ref="securityManager"/>
        <!-- 配置登录页面访问URL -->
        <property name="loginUrl" value="/login.html"/>
        <!-- 配置权限管理URL过滤器链(配置顺序为自上而下) -->
        <property name="filterChainDefinitions">
            <value>
                /css/** = anon
                /logout = logout
                /** = user
            </value>
        </property>
    </bean>
    <!-- 2. 配置安全管理器 -->
    <bean id="securityManager"
          class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
        <!-- 配置认证域(来自ini配置文件)-->
        <property name="realm" ref="iniRealm"/>
    </bean>
    <!-- 3. 配置IniRealm认证域 -->
    <bean id="iniRealm" class="org.apache.shiro.realm.text.IniRealm">
        <!-- 设置ini配置文件 -->
        <constructor-arg name="resourcePath" value="classpath:shiro.ini"/>
    </bean>
</beans>

配置说明：
<property name="filterChainDefinitions"></property>
配置权限管理URL过滤器链(配置顺序为自上而下)
1．user: 过滤器只要用户登录
(isRemembered()==true or isAuthenticated()==true)即可访问成功
2．authc: 过滤器只要用户登录isAuthenticated()==true即可访问成功
3．anon : 匿名访问，不需要登录
4．logout : 安全退出