shiro 注解授权不起作用问题解决方案

对于shiro 注解授权不起作用的解决方案如下：

1.如果是springmvc进行整合的话 开启注解需要写在springmvc对应的配置文件内

//配置异常捕获

<bean class="org.springframework.web.servlet.handler.SimpleMappingExceptionResolver"> 
<property name="exceptionMappings"> 
 <props> 
<prop key="org.apache.shiro.authz.UnauthorizedException">/error/302</prop>
 </props> 
 </property> 
</bean> 

//开启shiro注解
<bean class="org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator" depends-on="lifecycleBeanPostProcessor"/> 
<bean class="org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor">
  <property name="securityManager" ref="securityManager"/>
</bean>

shiro.xml配置如下：

<description>Shiro安全配置</description>


<!-- Shiro's main business-tier object for web-enabled applications -->
<bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
<property name="realm" ref="shiroDbRealm" />
</bean>


<!-- 項目自定义的Realm, 所有accountService依赖的dao都需要用depends-on声明 -->
<bean id="shiroDbRealm" class="com.hengbao.shiro.service.realm.ShiroDbRealm">
</bean>

<!-- Shiro Filter -->
<bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
<property name="securityManager" ref="securityManager" />
<property name="loginUrl" value="/login" />
<property name="successUrl" value="/index.jsp" />
<property name="unauthorizedUrl" value="/error/302.jsp"/>//没有授权时跳转的错误页面
<property name="filterChainDefinitions">
<value>
/login = authc
/logout = logout
/static/** = anon
/api/** = anon
/register/** = anon
/admin/** = roles[admin]
/** = authc
</value>
</property>
</bean>



<!-- 保证实现了Shiro内部lifecycle函数的bean执行 -->
<bean id="lifecycleBeanPostProcessor" class="org.apache.shiro.spring.LifecycleBeanPostProcessor"/>

3.登陆界面接受准确的错误信息提示

接收准确的异常信息需要自定义filter 继承FormAuthenticationFilter 重写onLoginFailure方法 异常信息捕获到后传递给controller  详细代码如下：

protected boolean onLoginFailure(AuthenticationToken token,AuthenticationException e, ServletRequest request,ServletResponse response) {
boolean result = super.onLoginFailure(token, e, request, response);
String errorMessage = "用户名或者密码错误";
if (e instanceof CaptchaException) {
errorMessage = "验证码输入错误";
} 
request.setAttribute("authenticationErrorMessage", errorMessage);
return result;
}