@wendal 粗粒度就是url权限控制，细粒度就是方法控制。我现在写的一个demo是用的url控制。

这是shiro.ini

[main]
nutzdao_realm = net.wendal.nutzbook.shiro.realm.LoginRealm

authc = org.nutz.integration.shiro.SimpleAuthenticationFilter
authc.loginUrl  = /login.jsp
logout.redirectUrl= /login.jsp

[urls]
/rs/*        = anon
/user/logout = logout
/user/error  = anon
/user/login  = anon
/user/profile/active/mail = anon
/upload/down =authc

在mianmodule上面有注解

@SessionBy(ShiroSessionProvider.class)

这是realm

public class LoginRealm extends AuthorizingRealm{

	private Dao dao;
	
	@Override
	protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection arg0) {
		System.out.println("授权管理");
		SimpleAuthorizationInfo sin=new SimpleAuthorizationInfo();
		Subject sub = SecurityUtils.getSubject();
		User user = (User) sub.getPrincipal();
		if(user.getUsername().equals("faker")) {
			sin.addRole("admin");
		}
		
		
		return sin;
	}

	@Override
	protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
		System.out.println("认证管理");
		UsernamePasswordToken uptoke=(UsernamePasswordToken) token;
		
		 if (dao == null) {
	        dao = Mvcs.ctx().getDefaultIoc().get(Dao.class, "dao");
		 }
		
		User user = dao.fetch(User.class,Cnd.where("username","=",uptoke.getUsername()));
		System.out.println(user);
		
		return new SimpleAuthenticationInfo(user,user.getPassword(),getName());
	}

}

下面是入口函数

@At//登录
	public Object login(@Param("..")User user) {
		Subject sub = SecurityUtils.getSubject();
		AuthenticationToken token=new UsernamePasswordToken(user.getUsername(), user.getPassword());
		try {
			sub.login(token);
			return "成功";
		} catch (AuthenticationException e) {
			// TODO Auto-generated catch block
			e.printStackTrace();
			return "失败";
		}
		
	}

用起来没有问题，但是我想弄一下类似spring里面的那种注解控制方法权限的用法，没有找到什么资料。

@wendal 哦，在nutz里面使用不需要激活注解的配置，谢了