shiro 认证问题报错 

自己实现AuthorizingRealm类，然后验证用户和权限，这里需要自己实现功能，跟数据库交互的。

/** * 自定义Realm 处理登录 权限 * * @author ruoyi */ public class UserRealm extends AuthorizingRealm { private static final Logger log = LoggerFactory.getLogger(UserRealm.class);

@Autowired
private IMenuService menuService;

@Autowired
private IRoleService roleService;

@Autowired
private LoginService loginService;

/**
 * 授权
 */
@Override
protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection arg0)
{
    Long userId = ShiroUtils.getUserId();
    SimpleAuthorizationInfo info = new SimpleAuthorizationInfo();
    // 角色加入AuthorizationInfo认证对象
    info.setRoles(roleService.selectRoleKeys(userId));
    // 权限加入AuthorizationInfo认证对象
    info.setStringPermissions(menuService.selectPermsByUserId(userId));
    return info;
}

/**
 * 登录认证
 */
@Override
protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException
{
    UsernamePasswordToken upToken = (UsernamePasswordToken) token;
    String username = upToken.getUsername();
    String password = "";
    if (upToken.getPassword() != null)
    {
        password = new String(upToken.getPassword());
    }

    User user = null;
    try
    {
        user = loginService.login(username, password);
    }
    catch (UserNotExistsException e)
    {
        throw new UnknownAccountException(e.getMessage(), e);
    }
    catch (UserPasswordNotMatchException e)
    {
        throw new IncorrectCredentialsException(e.getMessage(), e);
    }
    catch (UserPasswordRetryLimitExceedException e)
    {
        throw new ExcessiveAttemptsException(e.getMessage(), e);
    }
    catch (UserBlockedException e)
    {
        throw new LockedAccountException(e.getMessage(), e);
    }
    catch (RoleBlockedException e)
    {
        throw new LockedAccountException(e.getMessage(), e);
    }
    catch (Exception e)
    {
        log.info("对用户[" + username + "]进行登录验证..验证未通过{}", e.getMessage());
        throw new AuthenticationException(e.getMessage(), e);
    }
    SimpleAuthenticationInfo info = new SimpleAuthenticationInfo(user, password, getName());
    return info;
}

}

    /** * Returns {@code true} if the provided token credentials match the stored account credentials, * {@code false} otherwise. * * @param token   the {@code AuthenticationToken} submitted during the authentication attempt * @param info the {@code AuthenticationInfo} stored in the system. * @return {@code true} if the provided token credentials match the stored account credentials, *         {@code false} otherwise. / boolean doCredentialsMatch(AuthenticationToken token, AuthenticationInfo info);

    /* * Constructor that takes in a single 'primary' principal of the account, its corresponding hashed credentials, * the salt used to hash the credentials, and the name of the realm to associate with the principals. * <p/> * This is a convenience constructor and will construct a {@link PrincipalCollection PrincipalCollection} based * on the <code>principal</code> and <code>realmName</code> argument. * * @param principal         the 'primary' principal associated with the specified realm. * @param hashedCredentials the hashed credentials that verify the given principal. * @param credentialsSalt   the salt used when hashing the given hashedCredentials * @param realmName         the realm from where the principal and credentials were acquired. * @see org.apache.shiro.authc.credential.HashedCredentialsMatcher HashedCredentialsMatcher * @since 1.1 / public SimpleAuthenticationInfo(Object principal, Object hashedCredentials, ByteSource credentialsSalt, String realmName)

 /* * The default query used to retrieve account data for the user. */ protected static final String DEFAULT_AUTHENTICATION_QUERY = "select password from users where username = ?";

/**
 * The default query used to retrieve account data for the user when {@link #saltStyle} is COLUMN.
 */
protected static final String DEFAULT_SALTED_AUTHENTICATION_QUERY = "select password, password_salt from users where username = ?";

/**
 * The default query used to retrieve the roles that apply to a user.
 */
protected static final String DEFAULT_USER_ROLES_QUERY = "select role_name from user_roles where username = ?";

/**
 * The default query used to retrieve permissions that apply to a particular role.
 */
protected static final String DEFAULT_PERMISSIONS_QUERY = "select permission from roles_permissions where role_name = ?";

doGetAuthenticationInfo  此方法是判断用户是否合法。你可以注入一个dao读取数据库来判断token登录是否合法。登录成功获取用户权限,我是写入session中。

doGetAuthorizationInfo  此方法是取用户的权限列表。我是从session中读取出来