shiro 訪問鑒權：Realm
AuthorizingRealm->doGetAuthorizationInfo
doGetAuthorizationInfo
protected abstract AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals)
Retrieves the AuthorizationInfo for the given principals from the underlying data store. When returning an instance from this method, you might want to consider using an instance of SimpleAuthorizationInfo, as it is suitable in most cases.
Parameters:
principals - the primary identifying principals of the AuthorizationInfo that should be retrieved.
Returns:
the AuthorizationInfo associated with this principals.
See Also:
SimpleAuthorizationInfo
shiro 需要訪問數據庫查詢權限信息。
結合緩存框架，第一次查詢權限信息后緩存，在緩存生存期內，訪問鑒權使用緩存中的權限信息。
優點：減少數據庫查詢，緩存快速獲取，提升了每次訪問效率，減少了數據庫壓力。
缺點：涉及權限修改，生效會有一個最大緩存生存周期的間隔期。
解決方法：
每次修改權限后，調用 clearCachedAuthorizationInfo 刷新權限：
clearCachedAuthorizationInfo
protected void clearCachedAuthorizationInfo(PrincipalCollection principals)
Clears out the AuthorizationInfo cache entry for the specified account.
This method is provided as a convenience to subclasses so they can invalidate a cache entry when they change an account's authorization data (add/remove roles or permissions) during runtime. Because an account's AuthorizationInfo can be cached, there needs to be a way to invalidate the cache for only that account so that subsequent authorization operations don't used the (old) cached value if account data changes.
After this method is called, the next authorization check for that same account will result in a call to getAuthorizationInfo, and the resulting return value will be cached before being returned so it can be reused for later authorization checks.
If you wish to clear out all associated cached data (and not just authorization data), use the CachingRealm.clearCache(org.apache.shiro.subject.PrincipalCollection) method instead (which will in turn call this method by default).
Parameters:
principals - the principals of the account for which to clear the cached AuthorizationInfo.
示例項目：https://github.com/windwant/spring-dubbo-service
https://github.com/windwant/spring-boot-service