@Override
	protected void initFilterBean() throws ServletException {
		synchronized (this.delegateMonitor) {
            //如果代理Filter是空对象则进行查找
			if (this.delegate == null) {
				// 如果targetBeanName是空，则获取FilterName作为targetBeanName
				if (this.targetBeanName == null) {
                    //此步getFilterName是从FilterConfig里获取filtername
					this.targetBeanName = getFilterName();
				}
				//这里通过serveletContext获取到了springweb容器
				WebApplicationContext wac = findWebApplicationContext();
				if (wac != null) {
                    //然后在web容器中获取对应的Filter,下面再看看是如何获取的。
					this.delegate = initDelegate(wac);
				}
			}
		}
	}

protected Filter initDelegate(WebApplicationContext wac) throws ServletException {
		String targetBeanName = getTargetBeanName();
		Assert.state(targetBeanName != null, "No target bean name set");
    	//利用targetBeanName在容器中获取。
		Filter delegate = wac.getBean(targetBeanName, Filter.class);
    	//这里调用了初始化方法，判断了TargetFilterLifecycle属性
		if (isTargetFilterLifecycle()) {
			delegate.init(getFilterConfig());
		}
		return delegate;
	}

@Override
	public void doFilter(ServletRequest request, ServletResponse response, FilterChain filterChain)
			throws ServletException, IOException {

		// 前面进行判断当Delegate对象不存在时去容器中寻找。
		Filter delegateToUse = this.delegate;
		if (delegateToUse == null) {
			synchronized (this.delegateMonitor) {
				delegateToUse = this.delegate;
				if (delegateToUse == null) {
					WebApplicationContext wac = findWebApplicationContext();
					if (wac == null) {
						throw new IllegalStateException("No WebApplicationContext found: " +
								"no ContextLoaderListener or DispatcherServlet registered?");
					}
					delegateToUse = initDelegate(wac);
				}
				this.delegate = delegateToUse;
			}
		}

		// 此处调用了Delegate对象的doFilter方法。
		invokeDelegate(delegateToUse, request, response, filterChain);
	}

/**
     * shiro安全框架必须的拦截器，它只是一个代理，会根据targetBeanName（shiroFilter）在spring容器中查	 * 找Bean
     * 并把所有的Filter操作委托给这个bean操作。即实际起作用的对象是shiroFilter
     * @return
     */
    @Bean
    public FilterRegistrationBean shiroFilterRegistrationBean(){
        FilterRegistrationBean registration = new FilterRegistrationBean();
        registration.setFilter(new DelegatingFilterProxy("shiroFilter"));
        registration.setEnabled(true);
        registration.setOrder(Integer.MAX_VALUE - 1);
        registration.addUrlPatterns("/*");
        return registration;

    }

public Object getObject() throws Exception {
        if (this.instance == null) {
            this.instance = this.createInstance();
        }
        return this.instance;
    }

protected AbstractShiroFilter createInstance() throws Exception {
    log.debug("Creating Shiro Filter instance.");
    SecurityManager securityManager = this.getSecurityManager();
    String msg;
    if (securityManager == null) {
        msg = "SecurityManager property must be set.";
        throw new BeanInitializationException(msg);
    } else if (!(securityManager instanceof WebSecurityManager)) {
        msg = "The security manager does not implement the WebSecurityManager interface.";
        throw new BeanInitializationException(msg);
    } else {
        FilterChainManager manager = this.createFilterChainManager();
        PathMatchingFilterChainResolver chainResolver = new PathMatchingFilterChainResolver();
        chainResolver.setFilterChainManager(manager);
        return new ShiroFilterFactoryBean.SpringShiroFilter((WebSecurityManager)securityManager, chainResolver);
    }
}

new DefaultFilterChainManager()
    
    public DefaultFilterChainManager() {
        this.filters = new LinkedHashMap<String, Filter>();
        this.filterChains = new LinkedHashMap<String, NamedFilterList>();
    	//这里将默认的shiroFilter添加到 this.filters中
        addDefaultFilters(false);
    }
/**
* DefaultFilter 枚举类，存储了默认的Filter
*/
protected void addDefaultFilters(boolean init) {
    //遍历添加枚举类中的Filter
        for (DefaultFilter defaultFilter : DefaultFilter.values()) {
            addFilter(defaultFilter.name(), defaultFilter.newInstance(), init, false);
        }
    }

ByteSource credentialsSalt = ByteSource.Util.bytes(principal);
return new SimpleAuthenticationInfo(principal,"0192023a7bbd73250516f069df18b500",credentialsSalt,getName());

package cn.com.pansky.shirodemo.shiro;

import org.apache.shiro.authc.*;
import org.apache.shiro.realm.AuthenticatingRealm;
import org.springframework.stereotype.Component;

/**
 * 描述:
 * 自定义realm
 *
 * @author Xue_Pan
 * @create 2019-01-31 10:09
 */
@Component
public class ShiroRealm extends AuthorizingRealm {

    @Override
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
        UsernamePasswordToken usernamePasswordToken = (UsernamePasswordToken) token;
        String principal = (String)usernamePasswordToken.getPrincipal();
        if(!"admin".equals(principal)){
            throw new UnknownAccountException("用户名密码错误");
        }
        return new SimpleAuthenticationInfo(principal,"123",getName());
    }
    
    /**
     * 授权(验证权限时调用)
     */
    @Override
    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {
        //这里获取的是登录时传递的principal。
        SysUserEntity user = (SysUserEntity) principals.getPrimaryPrincipal();
        Long userId = user.getUserId();
		//然后从数据库或者缓存中获取用户的权限。
        List<String> permsList;
        //用户权限列表
        Set<String> permsSet = new HashSet<>();
       	....
        SimpleAuthorizationInfo info = new SimpleAuthorizationInfo();
        info.setStringPermissions(permsSet);
        return info;
    }
}

/**
     * 注入安全管理器
     * @return
     */
    @Bean
    public SecurityManager securityManager(ShiroRealm shiroRealm){
        DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager();
        HashedCredentialsMatcher credentialsMatcher = new HashedCredentialsMatcher();
        //指定加密算法
        credentialsMatcher.setHashAlgorithmName("MD5");
        //指定加密的次数
        credentialsMatcher.setHashIterations(1);
        shiroRealm.setCredentialsMatcher(credentialsMatcher);
        securityManager.setRealm(shiroRealm);
        return securityManager;

    }

    @Bean
    public ShiroFilterFactoryBean shiroFilter(SecurityManager securityManager){
        ShiroFilterFactoryBean shiroFilter = new ShiroFilterFactoryBean();
        shiroFilter.setSecurityManager(securityManager);
        return shiroFilter;
    }