shiro 授权流程

  public boolean hasRole(String roleIdentifier)
    {
        return hasPrincipals() && securityManager.hasRole(getPrincipals(), roleIdentifier);
    }

securityManager 为DefaultSecurityManager

调用securityManager.hasRole或securityManager.isPermitted 其实是调用DefaultSecurityManager

的父类

 public boolean hasRole(PrincipalCollection principals, String roleIdentifier)
    {
        return authorizer.hasRole(principals, roleIdentifier);
    }

或者
     public boolean isPermitted(PrincipalCollection principals, String permissionString)
    {
        return authorizer.isPermitted(principals, permissionString);
    }

其中authorizer = new ModularRealmAuthorizer();

 public boolean hasRole(PrincipalCollection principals, String roleIdentifier)
    {
        assertRealmsConfigured();
        for(Iterator i$ = getRealms().iterator(); i$.hasNext();)
        {
            Realm realm = (Realm)i$.next();
            if((realm instanceof Authorizer) && ((Authorizer)realm).hasRole(principals, roleIdentifier))
                return true;
        }

        return false;
    }

  public boolean isPermitted(PrincipalCollection principals, String permission)
    {
        assertRealmsConfigured();
        for(Iterator i$ = getRealms().iterator(); i$.hasNext();)
        {
            Realm realm = (Realm)i$.next();
            if((realm instanceof Authorizer) && ((Authorizer)realm).isPermitted(principals, permission))
                return true;
        }

        return false;
    }

  public boolean hasRole(PrincipalCollection principal, String roleIdentifier)
    {
        AuthorizationInfo info = getAuthorizationInfo(principal);
        return hasRole(roleIdentifier, info);
    }

    protected boolean hasRole(String roleIdentifier, AuthorizationInfo info)
    {
        return info != null && info.getRoles() != null && info.getRoles().contains(roleIdentifier);
    }

或者  
  public boolean isPermitted(PrincipalCollection principals, String permission)
    {
        Permission p = getPermissionResolver().resolvePermission(permission);
        return isPermitted(principals, p);
    }

    public boolean isPermitted(PrincipalCollection principals, Permission permission)
    {
        AuthorizationInfo info = getAuthorizationInfo(principals);
        return isPermitted(permission, info);
    }

    private boolean isPermitted(Permission permission, AuthorizationInfo info)
    {
label0:
        {
            Collection perms = getPermissions(info);
            if(perms == null || perms.isEmpty())
                break label0;
            Iterator i$ = perms.iterator();
            Permission perm;
            do
            {
                if(!i$.hasNext())
                    break label0;
                perm = (Permission)i$.next();
            } while(!perm.implies(permission));
            return true;
        }
        return false;
    }