1 //授权方法
 2 protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {
 3
 4     SimpleAuthorizationInfo info = new SimpleAuthorizationInfo();
 5
 6     // 获取用户对象
 7     TUser user = (TUser) SecurityUtils.getSubject().getPrincipal();
 8 //        TUser user2 = (TUser) principals.getPrimaryPrincipal();
 9 //        System.out.println(user1 == user2);
10
11     List<Function> functionList = null;
12     if (user.getUsername().equals("admin")){
13         DetachedCriteria dc = DetachedCriteria.forClass(Function.class);
14         functionList = functionDao.findAll(dc);
15     }else{
16         functionList = functionDao.findByUserId(user.getId());
17     }
18
19
20     for (Function f: functionList) {
21         info.addStringPermission(f.getCode());
22     }
23     // 直接（不查数据库）为用户授权
24 //        info.addStringPermission("staff-list");
25
26     return info;
27 }

 1 @Override
 2 public List<Function> findByUserId(String id) {
 3
 4     // distinct==》去重
 5     String hql = "select distinct f from Function f inner join f.roles r inner join r.users u where u.id=?";
 6
 7     List<Function> list = (List<Function>) super.getHibernateTemplate().find(hql,id);
 8
 9     return list;
10 }

 1 <!--配置安全管理器-->
 2 <bean name="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
 3     <property name="realm" ref="bosRealm"/>
 4     <!--注入缓存管理器-->
 5     <property name="cacheManager" ref="cacheManager"/>
 6 </bean>
 7
 8 <!--注册缓存管理器-->
 9 <bean name="cacheManager" class="org.apache.shiro.cache.ehcache.EhCacheManager">
10     <!--注入ehcache配置文件-->
11     <property name="cacheManagerConfigFile" value="classpath:ehcache.xml"/>
12 </bean>