<dependency>
    <groupId>org.apache.shiro</groupId>
    <artifactId>shiro-core</artifactId>
    <version>1.5.0</version>
</dependency>

import org.apache.shiro.crypto.hash.Md5Hash;
import org.apache.shiro.crypto.hash.SimpleHash;
import org.apache.shiro.util.ByteSource;

import java.security.SecureRandom;
import java.util.Random;

public class ShiroUtils {

    /**
     * 哈希算法名称
     */
    public final static String HASH_ALGORITHM_NAME = "MD5";

    /**
     * 哈希迭代次数
     */
    public final static int HASH_ITERATIONS = 1024;

    /**
     * 密码加密方法
     *
     * @param credentials 密码明文
     * @param saltSource  盐值（建议唯一，如用户名或随机串）
     * @return 加密后的十六进制字符串
     */
    public static String md5(String credentials, String saltSource) {
        ByteSource salt = new Md5Hash(saltSource); // 将 salt 也进行一次 MD5，增强安全性
        return new SimpleHash(HASH_ALGORITHM_NAME, credentials, salt, HASH_ITERATIONS).toString();
    }

    /**
     * 生成指定长度的随机盐值
     *
     * @param length 盐的长度
     * @return 随机盐字符串
     */
    public static String getRandomSalt(int length) {
        return getRandomString(length);
    }

    /**
     * 私有方法：生成由小写字母和数字组成的随机字符串
     *
     * @param length 字符串长度
     * @return 随机字符串
     */
    private static String getRandomString(int length) {
        String base = "abcdefghijklmnopqrstuvwxyz0123456789";
        SecureRandom random = new SecureRandom(); // 使用更安全的 SecureRandom
        StringBuilder sb = new StringBuilder();
        for (int i = 0; i < length; i++) {
            int index = random.nextInt(base.length());
            sb.append(base.charAt(index));
        }
        return sb.toString();
    }
}

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.authentication.BadCredentialsException;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.core.userdetails.UsernamePasswordAuthenticationToken;
import org.springframework.security.authentication.dao.DaoAuthenticationProvider;
import org.springframework.stereotype.Component;
import org.springframework.web.context.request.RequestContextHolder;
import org.springframework.web.context.request.ServletRequestAttributes;
import javax.servlet.http.HttpServletRequest;

@Component
public class SaltAuthenticationProvider extends DaoAuthenticationProvider {

    private final IUserClient userClient;

    @Autowired
    public SaltAuthenticationProvider(UserDetailsService userDetailsService, IUserClient userClient) {
        setUserDetailsService(userDetailsService);
        this.userClient = userClient;
    }

    @Override
    protected void additionalAuthenticationChecks(UserDetails userDetails,
                                                  UsernamePasswordAuthenticationToken authentication)
            throws AuthenticationException {

        HttpServletRequest request = ((ServletRequestAttributes) RequestContextHolder.currentRequestAttributes()).getRequest();

        // 获取租户标识（Header 或 参数）
        String headerTenant = request.getHeader(TokenUtil.TENANT_HEADER_KEY);
        String paramTenant = request.getParameter(TokenUtil.TENANT_PARAM_KEY);

        if (StringUtil.isAllBlank(headerTenant, paramTenant)) {
            throw new UserDeniedAuthorizationException(TokenUtil.TENANT_NOT_FOUND);
        }

        String tenantId = headerTenant != null ? headerTenant : paramTenant;

        if (authentication.getCredentials() == null) {
            logger.debug("Authentication failed: no credentials provided");
            throw new BadCredentialsException(messages.getMessage("AbstractUserDetailsAuthenticationProvider.badCredentials", "Bad credentials"));
        }

        // 查询用户盐值
        String salt = userClient.userByAccount(tenantId, userDetails.getUsername())
                               .getData()
                               .getSalt();

        if (salt == null) {
            throw new BadCredentialsException("User salt not found.");
        }

        // 对输入密码进行解码（Base64）并加密比对
        String presentedPassword = authentication.getCredentials().toString();
        String decodedPassword = Base64Util.decode(presentedPassword); // 假设前端传的是 Base64 编码密码
        String encodedPassword = ShiroUtils.md5(decodedPassword, salt);

        // 与数据库中存储的加密密码比对
        if (!encodedPassword.equals(userDetails.getPassword())) {
            logger.debug("Authentication failed: password does not match stored value");
            throw new BadCredentialsException("Invalid credentials");
        }
    }
}