重寫AccessControlFilter的時候一直報下面這個錯誤，

org.apache.shiro.UnavailableSecurityManagerException: No SecurityManager accessible to the calling code, either bound to the org.apache.shiro.util.ThreadContext or as a vm static singleton.  This is an invalid application configuration.
    at org.apache.shiro.SecurityUtils
 
.getSecurityManager(SecurityUtils.java:123) ~[shiro-core-1.4.0.jar:1.4.0]
    at org.apache.shiro.subject.Subject$Builder.<init>(Subject.java:626) ~[shiro-core-1.4.0.jar:1.4.0]
    at org.apache.shiro.SecurityUtils.getSubject(SecurityUtils.java:56) ~[shiro-core-1.4.0.jar:1.4.0]
    at com.test.shiro
 
.filter.MyAccessControlFilter.onAccessDenied(MyAccessControlFilter.java:70) ~[classes/:na]

程式碼：

package com.test.shiro.filter;

import com.test.shiro.service.TokenService;
//import com.test.shiro.shiro.MyUsernamePasswordToken;
import org.apache.shiro.SecurityUtils;
import org.apache.shiro.authc.UsernamePasswordToken;
import
 
 org.apache.shiro.subject.Subject;
import org.apache.shiro.web.filter.AccessControlFilter;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.stereotype.Component;

import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;

/**
 * @author Created by pangkunkun on 2017/11/18.
 */
@Component
public class MyAccessControlFilter extends AccessControlFilter {

    private static final Logger log= LoggerFactory.getLogger(MyAccessControlFilter.class);


    /**
     *
     * 如果isAccessAllowed返回true則onAccessDenied方法不會繼續執行
     * 這裡可以用來判斷一些不被通過的連結（個人備註）
     * */
    @Override
    public boolean isAccessAllowed(ServletRequest servletRequest, ServletResponse servletResponse, Object object) throws Exception{
        return false;
    }

    /**
     * 表示當訪問拒絕時是否已經處理了；如果返回true表示需要繼續處理；如果返回false表示該攔截器例項已經處理了，將直接返回即可。
     * onAccessDenied是否執行取決於isAccessAllowed的值，如果返回true則onAccessDenied不會執行；如果返回false，執行onAccessDenied
     * 如果onAccessDenied也返回false，則直接返回，不會進入請求的方法（只有isAccessAllowed和onAccessDenied的情況下）
     * */
    @Override
    public boolean onAccessDenied(ServletRequest request, ServletResponse response) throws Exception{
        System.out.println("onAccessDenied");
        UsernamePasswordToken token1=new UsernamePasswordToken("admin","admin");
        Subject subject= SecurityUtils.getSubject();
        try {
            subject.login(token1);
//            subject.isPermitted("add");
            log.info("subject.hasRole(\"user\");"+subject.hasRole("user"));
        }catch (Exception e){
            log.info("登陸失敗");
            log.info(e.getMessage());
            onLoginFail(response);
            return false;
        }
        log.info("登陸成功");
        return true;
    }

    /**
     * 登入失敗
     * */
    private void onLoginFail(ServletResponse response) throws IOException {
        log.info("設定返回");
        HttpServletResponse httpResponse = (HttpServletResponse) response;
        httpResponse.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
//        httpResponse.getWriter().write("login error");
    }

    /**
     * TODO 跨域請求
     */
    private void dealCrossDomain(){

    }
}

查了好多資料感覺都不符合我的問題，後來仔細看異常，有一處This is an invalid application configuration.
這時想到了上面有個@Component註解，這個註解本來想做其它處理的，後來用不到了。將此註解去掉後重新執行OK了。

問題思考，Shiro中的filter是在專案本身的Filter鏈執行之前載入的，所以感覺這個標籤的存在讓它沒有被正常載入進Shiro的配置中，或者被註冊成了Spring的bean，無法被Shiro使用。