shiro使用注解（@RequiresPermissions等）不無效及異常處理

1、注解不生效

在shiro配置類中加上如下代碼：

　　/**
     * Shiro生命周期處理器
     */
    @Bean(name = "lifecycleBeanPostProcessor")
    public static LifecycleBeanPostProcessor getLifecycleBeanPostProcessor() {
        return new LifecycleBeanPostProcessor();
    }

    /**
     * 開啟Shiro的注解(如@RequiresRoles,@RequiresPermissions),需借助SpringAOP掃描使用Shiro注解的類,並在必要時進行安全邏輯驗證
     */
    @Bean
    @DependsOn("lifecycleBeanPostProcessor")
    public DefaultAdvisorAutoProxyCreator defaultAdvisorAutoProxyCreator() {
        DefaultAdvisorAutoProxyCreator creator = new DefaultAdvisorAutoProxyCreator();
        creator.setProxyTargetClass(true);
        return creator;
    }

　　/**
 　　* 開啟shiro aop注解支持.
 　　* 使用代理方式;所以需要開啟代碼支持;
 　　*/
　　@Bean
　　public AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor(SecurityManager securityManager) {
   　　 AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor = new AuthorizationAttributeSourceAdvisor();
    　　authorizationAttributeSourceAdvisor.setSecurityManager(securityManager);
   　　 return authorizationAttributeSourceAdvisor;
　　}

 

2、異常處理

過濾器必須要是AuthorizationFilter過濾器才能生效，即只有perms，roles，ssl，rest，port才是屬於AuthorizationFilter，而anon，authcBasic，auchc，user是AuthenticationFilter，所以unauthorizedUrl設置后頁面不跳轉。此處使用springmvc同意異常處理來解決：

package com.example.springbootshiro.controller;

import com.example.springbootshiro.constants.CommonConstants;
import com.example.springbootshiro.domain.vo.ResponseVO;
import com.example.springbootshiro.enums.ResponseStatusEnum;
import com.example.springbootshiro.utils.ResultUtil;
import org.apache.shiro.authz.AuthorizationException;
import org.apache.shiro.authz.UnauthorizedException;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.web.bind.annotation.ControllerAdvice;
import org.springframework.web.bind.annotation.ExceptionHandler;
import org.springframework.web.bind.annotation.ResponseBody;

import java.lang.reflect.UndeclaredThrowableException;

/**
 * 統一異常處理類<br>
 * 捕獲程序所有異常，針對不同異常，采取不同的處理方式
 *
 */
@ControllerAdvice
public class ExceptionHandleController {
    private static final Logger LOGGER = LoggerFactory.getLogger(ExceptionHandleController.class);

//    @ResponseBody
    @ExceptionHandler(UnauthorizedException.class)
    public String handleShiroException(Exception ex) {
        return "redirect:/error/403";
    }

//    @ResponseBody
    @ExceptionHandler(AuthorizationException.class)
    public String AuthorizationException(Exception ex) {
        return "redirect:/error/401";
    }

}

具體處理邏輯自己控制