shiro提供了對外驗證角色和許可權的API，都是通過Subject來呼叫。

@Test
	public void auth(){
		Subject subject=SecurityUtils.getSubject();
		UsernamePasswordToken token=new UsernamePasswordToken("zhang", "123");
		subject.login(token);
		if(subject.hasRole("role1")){
			System.out.println("have role");
		}else{
			System.out.println("not have role");
		}
		if(subject.isPermitted("user:update")){
			System.out.println("have permitted");
		}else{
			System.out.println("not have permitted");
		}
	}
 

當我們呼叫subject驗證使用者是否擁有某個角色.許可權時，Subject會委託給org.apache.shiro.mgt.SecurityManager

public boolean isPermitted(String permission) {
        return hasPrincipals() && securityManager.isPermitted(getPrincipals(), permission);
    }

public boolean hasRole(String roleIdentifier) {
        return hasPrincipals() && securityManager.hasRole(getPrincipals(), roleIdentifier);
    }
 

SecurityManager會委託給org.apache.shiro.authz.Authorizer

public abstract class AuthorizingSecurityManager extends AuthenticatingSecurityManager {


    private Authorizer authorizer;

    
    public AuthorizingSecurityManager() {
        super();
        this.authorizer = new ModularRealmAuthorizer();
    }
 

    public boolean hasRole(PrincipalCollection principals, String roleIdentifier) {
        return this.authorizer.hasRole(principals, roleIdentifier);
    }

許可權的驗證都是委託給Authorizer介面的定義如下：

public interface Authorizer{
	
	
    boolean isPermitted(PrincipalCollection principals, String permission);

    
    boolean isPermitted(PrincipalCollection subjectPrincipal, Permission permission);

    
    boolean[] isPermitted(PrincipalCollection subjectPrincipal, String... permissions);

   
    boolean[] isPermitted(PrincipalCollection subjectPrincipal, List<Permission> permissions);

   
    boolean isPermittedAll(PrincipalCollection subjectPrincipal, String... permissions);

   
    boolean isPermittedAll(PrincipalCollection subjectPrincipal, Collection<Permission> permissions);

    
    void checkPermission(PrincipalCollection subjectPrincipal, String permission) throws AuthorizationException;

   
    void checkPermission(PrincipalCollection subjectPrincipal, Permission permission) throws AuthorizationException;

   
    void checkPermissions(PrincipalCollection subjectPrincipal, String... permissions) throws AuthorizationException;

   
    void checkPermissions(PrincipalCollection subjectPrincipal, Collection<Permission> permissions) throws AuthorizationException;

    
    boolean hasRole(PrincipalCollection subjectPrincipal, String roleIdentifier);

    
    boolean[] hasRoles(PrincipalCollection subjectPrincipal, List<String> roleIdentifiers);

   
    boolean hasAllRoles(PrincipalCollection subjectPrincipal, Collection<String> roleIdentifiers);

    
    void checkRole(PrincipalCollection subjectPrincipal, String roleIdentifier) throws AuthorizationException;

    
    void checkRoles(PrincipalCollection subjectPrincipal, Collection<String> roleIdentifiers) throws AuthorizationException;

    
    void checkRoles(PrincipalCollection subjectPrincipal, String... roleIdentifiers) throws AuthorizationException;
    

}

org.apache.shiro.authz.ModularRealmAuthorizer是SecurityManager的預設實現，直接取Realm中找，找到了就返回true。

 public boolean hasRole(PrincipalCollection principals, String roleIdentifier) {
        assertRealmsConfigured();
        for (Realm realm : getRealms()) {
            if (!(realm instanceof Authorizer)) continue;
            if (((Authorizer) realm).hasRole(principals, roleIdentifier)) {
                return true;
            }
        }
        return false;
    }

public boolean isPermitted(PrincipalCollection principals, Permission permission) {
        assertRealmsConfigured();
        for (Realm realm : getRealms()) {
            if (!(realm instanceof Authorizer)) continue;
            if (((Authorizer) realm).isPermitted(principals, permission)) {
                return true;
            }
        }
        return false;
    }

結合第一章的身份認證，如果我們自定義realm，realm要實現的介面，做的事情很多，shiro提供了org.apache.shiro.realm.AuthorizingRealm，為我們實現好了這些介面的方法，我們只要提供許可權資訊和使用者認證資訊即可。demo如下

public class CustomRealm extends AuthorizingRealm {

	/**
	 * 獲取許可權資訊
	 * author wenyi
	 * time: 2017年10月9日上午9:23:43
	 */
	@Override
	protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {
		//登入的時候放入的使用者資訊
		User user=(User) principals.getPrimaryPrincipal();
		//虛擬碼，根據使用者資訊查到角色和許可權
		//.....
		
		
		SimpleAuthorizationInfo info=new SimpleAuthorizationInfo();
		//新增角色
		String role="role1";
		info.addRole(role);
		//新增許可權
		String permission="user:update";
		info.addStringPermission(permission);
		return info;
	}

	/**
	 * 
	 * 進行登入認證
	 * author wenyi
	 * time: 2017年10月9日上午9:24:18
	 */
	@Override
	protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
		UsernamePasswordToken userToken=(UsernamePasswordToken)token;
		String userName=userToken.getUsername();
		//虛擬碼，根據token取到對應的使用者資訊，shiro只會比較密碼是否正確，不會再比較使用者名稱
		User user=new User();
		user.setUserName(userName);
		//虛擬碼，這個是根據token查到的密碼，shiro會比較登入的密碼與這個密碼是否一致
		String password="from db";
		return new SimpleAuthenticationInfo(user, password, getName());
	}

}