@Override
public AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {
SimpleAuthorizationInfo info = new SimpleAuthorizationInfo();
Set<String> permissionsSet = //logic to get the permissions here
info.addStringPermissions(permissionsSet);
SecurityUtils.getSubject().getSession().setAttribute("permissions", permissionsSet);
return info;
}
1、在自定义的realm中,把userPermissions当做参数注册到session里面
获取权限信息
2、直接从db里面获取不就好了。