spring整合shiro使用注解方式配置

第一步：在spring配置文件中开启shiro注解支持

第二步：在Action的方法上使用shiro注解

@RequiresPermissions("staff-delete")  //执行这个方法，需要 当前用户有staff-delete的这个权限
	public String deleteBatch(){
		staffService.deleteBatch(ids);
		return LIST;
	}

这时使用删除这个功能时，就会抛出一个异常，显示没有这个权限异常，这时需要配置异常处理页面

HTTP Status 500 - Subject does not have permission [staff-delete]

type Exception report

message Subject does not have permission [staff-delete]

description The server encountered an internal error that prevented it from fulfilling this request.

exception

org.apache.shiro.authz.UnauthorizedException: Subject does not have permission [staff-delete]
	org.apache.shiro.authz.ModularRealmAuthorizer.checkPermission(ModularRealmAuthorizer.java:323)
	org.apache.shiro.mgt.AuthorizingSecurityManager.checkPermission(AuthorizingSecurityManager.java:137)
	org.apache.shiro.subject.support.DelegatingSubject.checkPermission(DelegatingSubject.java:205)
	org.apache.shiro.authz.aop.PermissionAnnotationHandler.assertAuthorized(PermissionAnnotationHandler.java:74)
	org.apache.shiro.authz.aop.AuthorizingAnnotationMethodInterceptor.assertAuthorized(AuthorizingAnnotationMethodInterceptor.java:84)
	org.apache.shiro.authz.aop.AnnotationsAuthorizingMethodInterceptor.assertAuthorized(AnnotationsAuthorizingMethodInterceptor.java:100)
	org.apache.shiro.authz.aop.AuthorizingMethodInterceptor.invoke(AuthorizingMethodInterceptor.java:38)
	org.apache.shiro.spring.security.interceptor.AopAllianceAnnotationsAuthorizingMethodInterceptor.invoke(AopAllianceAnnotationsAuthorizingMethodInterceptor.java:115)
	org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:179)
	org.springframework.aop.framework.CglibAopProxy$DynamicAdvisedInterceptor.intercept(CglibAopProxy.java:655)
	com.itheima.bos.web.action.StaffAction$$EnhancerBySpringCGLIB$$fb175177.deleteBatch()
	sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
	sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
	java.lang.reflect.Method.invoke(Method.java:498)
	ognl.OgnlRuntime.invokeMethod(OgnlRuntime.java:891)
	ognl.OgnlRuntime.callAppropriateMethod(OgnlRuntime.java:1293)

第三步：在struts.xml中配置全局异常捕获，当shiro框架抛出权限不足异常时，跳转到权限不足提示页面

                
			/login.jsp
			/unauthorized.jsp
		
		
		
			
			
		

这里说一下第一步中为什么proxyTargetClass使用默认的false会出问题。因为使用默认值false，它会使用jdk的代理对象的方式，利用反射生成一个实现代理接口的匿名类，接口中并没有子类的特有方法，会导致抛出“没有这个方法”的异常。将proxyTargetClass设置为true，使用cglib就不会报错，因为cglib是对代理对象类的class文件加载进来，通过修改其字节码生成子类来处理。