shiro 不执行授权方法 doGetAuthorizationInfo()

ShiroDbRealm.java 代码如下

public class ShiroDbRealm extends AuthorizingRealm {

    @Resource
    private UserService userService;

    /**
     * 认证回调函数,登录时调用.
     */
    @Override
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authcToken) throws AuthenticationException {
        UsernamePasswordToken token = (UsernamePasswordToken) authcToken;
        User currentUser = userService.findByUserName(token.getUsername());
        if (currentUser != null) {
            if (currentUser.getStatus()==User.STATUS_DISABLED) {
                throw new DisabledAccountException("用户已注销");
            }else if(currentUser.getStatus()==User.STATUS_NOT_ACTIVE){
                throw new DisabledAccountException("用户未激活");//这里需要编写一个用户未激活异常
            }
            return new SimpleAuthenticationInfo(currentUser.getUsername(),currentUser.getUserpwd(), "");
        }
        return null;
    }

    /**
     * 授权查询回调函数, 进行鉴权但缓存中无用户的授权信息时调用.
     */
    @Override
    protected AuthorizationInfo doGetAuthorizationInfo(
            PrincipalCollection principals) {
        // Cache<Object, AuthenticationInfo> authenticationCache =
        // getAuthenticationCache();
        String primaryPrincipal = (String) principals.getPrimaryPrincipal();
        System.out.println("-----------*************************------------>"+ primaryPrincipal);
        List<String> roles = new ArrayList<String>();  
        List<String> permissions = new ArrayList<String>();

        SimpleAuthorizationInfo info = new SimpleAuthorizationInfo();

        User user = userService.findByUserName(primaryPrincipal);
        if(user != null){
            for (Role role : user.getRoles()) {
                roles.add(role.getName());
                for (Permission p : role.getPermissions()) {
                    permissions.add(p.getPrivilege());
                }
            }
        }else{
            throw new AuthorizationException();
        }
        //给当前用户设置角色
        info.addRoles(roles);
        //给当前用户设置权限
        info.addStringPermissions(permissions); 

        return info;
    }
}

applicationContext-shiro.xml配置

 <beans xmlns="http://www.springframework.org/schema/beans"
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
       xsi:schemaLocation="
       http://www.springframework.org/schema/beans
       http://www.springframework.org/schema/beans/spring-beans-3.2.xsd">

    <description>Shiro安全配置</description>

    <!-- Shiro's main business-tier object for web-enabled applications -->
    <bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
        <property name="realm" ref="shiroDbRealm"/>
        <property name="cacheManager" ref="shiroEhcacheManager"/>
    </bean>

    <!-- 項目自定义的Realm -->
    <bean id="shiroDbRealm" class="com.wsq.app.service.common.ShiroDbRealm">
        <!-- <property name="userService" ref="userService"/>  这里我在项目中只用了注解注入-->
    </bean>


    <!-- Shiro Filter -->
    <bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
        <!-- 这个属性是必须的 -->
        <property name="securityManager" ref="securityManager"/>
        <!-- 没有登录的用户请求需要登录的页面时自动跳转到登录页面，不是必须的属性，不输入地址的话会自动寻找项目web项目的根目录下的”/login.jsp”页面 -->
        <property name="loginUrl" value="/login"/>
        <!-- 登录成功默认跳转页面，不配置则跳转至”/”。如果登陆前点击的一个需要登录的页面，则在登录自动跳转到那个需要登录的页面。不跳转到此 -->
        <property name="successUrl" value="/"/>
        <!-- 没有权限默认跳转的页面 -->
        <property name="unauthorizedUrl" value=""/>
        <!-- 就是需要验证的地址的列表，常用的包含anon、authc、perms、roles、user、logout。 -->
        <property name="filterChainDefinitions">
            <value>
                /static/** = anon
                /login = anon
                /login/** = anon
                /logout = user
                /** = authc
            </value>
        </property>
    </bean>

    <!-- 用户授权信息Cache, 采用EhCache -->
    <bean id="shiroEhcacheManager" class="org.apache.shiro.cache.ehcache.EhCacheManager">
        <property name="cacheManagerConfigFile" value="classpath:resource/ehcache-shiro.xml"/>
    </bean>

    <!-- 保证实现了Shiro内部lifecycle函数的bean执行 -->
    <bean id="lifecycleBeanPostProcessor" class="org.apache.shiro.spring.LifecycleBeanPostProcessor"/>

    <!-- AOP式方法级权限检查  -->
    <bean class="org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator" depends-on="lifecycleBeanPostProcessor">
        <property name="proxyTargetClass" value="true"/>
    </bean>

    <bean class="org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor">
        <property name="securityManager" ref="securityManager"/>
    </bean>

</beans>

web.xml配置

 <!-- Shiro Security filter -->
    <filter>
        <filter-name>shiroFilter</filter-name>
        <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
    </filter>
    <filter-mapping>
        <filter-name>shiroFilter</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>

在spring-mvc的配置文件中，添加

引用

<aop:config proxy-target-class="true"></aop:config>
    <bean class="org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor">
        <property name="securityManager" ref="securityManager"/>
    </bean>

参考：http://ask.csdn.net/questions/201357