重写授权方法：

package net.retror.bd.shiro.realm;

import java.util.List;
import net.retror.bd.bean.User;
import net.retror.bd.service.UserOpService;
import org.apache.shiro.authc.AuthenticationException;
import org.apache.shiro.authc.AuthenticationInfo;
import org.apache.shiro.authc.AuthenticationToken;
import org.apache.shiro.authc.SimpleAccount;
import org.apache.shiro.authc.credential.CredentialsMatcher;
import org.apache.shiro.authz.AuthorizationInfo;
import org.apache.shiro.authz.SimpleAuthorizationInfo;
import org.apache.shiro.cache.CacheManager;
import org.apache.shiro.realm.AuthorizingRealm;
import org.apache.shiro.subject.PrincipalCollection;
import org.nutz.dao.Dao;
import org.nutz.dao.entity.Record;
import org.nutz.integration.shiro.SimpleShiroToken;
import org.nutz.mvc.Mvcs;
/**
 *
 * @author Retror
 */
public class SimpleAuthorizingRealm extends AuthorizingRealm {
    //声明自定义service，并生成getter和setter方法，在getter方法利用Nutz方法获取自定义service
    private UserOpService userOpService;
    
    protected Dao dao;

    //授权
    /**
     *
     * @param principals
     * @return
     */
    @Override
    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {
        System.out.println("doGetAuthorizationInfo......");
        // null usernames are invalid
//        if (principals == null) {
//            throw new AuthorizationException("PrincipalCollection method argument cannot be null.");
//        }
//        int userId = (Integer) principals.getPrimaryPrincipal();
//        User user = dao().fetch(User.class, userId);
//        if (user == null)
//            return null;
//
//        SimpleAuthorizationInfo auth = new SimpleAuthorizationInfo();
//        user = dao().fetchLinks(user, null);
//        return auth;
        
        //用户名  
        //String username = (String) principals.fromRealm(getName()).iterator().next();  
        //Integer username = (Integer) principals.fromRealm(getName()).iterator().next(); 
        Integer userId = (Integer)principals.fromRealm(getName()).iterator().next(); 
        User user = dao().fetch(User.class, userId.longValue());
        if(user!=null){
            //根据用户ID去查询其角色和拥有的权限
            List<Record> lists = getUserOpService().getRolePermissionData(userId);
            SimpleAuthorizationInfo info = new SimpleAuthorizationInfo(); 
            for(Record record:lists){
                info.addRole(record.getString("roleCode"));
                info.addStringPermission(record.getString("roleCode")+":"+record.getString("resourceDesp"));
                System.out.println(record.getString("roleCode")+":"+record.getString("resourceDesp"));
            }
            return info;
        }
        
//        String username = user.getUserName();
//        //String username = "guest";
//         
//        /*这些代码应该是动态从数据库中取出的，此处写死*/  
//        if(username!=null&&username.equals("admin")){  
//            SimpleAuthorizationInfo info = new SimpleAuthorizationInfo();  
//            info.addRole("ROLE_ADMIN");//添加一个角色，不是配置意义上的添加，而是证明该用户拥有admin角色  
//            info.addStringPermission("ROLE_ADMIN:sys-manage");//添加权限  
//            return info;  
//            
//
//        }
//        else{
//            SimpleAuthorizationInfo info = new SimpleAuthorizationInfo();  
//            info.addRole("ROLE_GUEST");//添加一个角色，不是配置意义上的添加，而是证明该用户拥有admin角色  
//            info.addStringPermission("ROLE_GUEST:manage");//添加权限  
//            return info; 
//        }
        return null;
        
        
        
    }

    //认证
    /**
     *
     * @param token
     * @return
     * @throws AuthenticationException
     */
    @Override
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
        System.out.println("doGetAuthenticationInfo......");
        SimpleShiroToken upToken = (SimpleShiroToken) token;

        //还可以把用户存储到session当中
        
        User user = dao().fetch(User.class, ((Integer)upToken.getPrincipal()).longValue());
        if (user == null)
            return null;
        return new SimpleAccount(user.getUserId(), user.getPassword(), getName());
    }
    
    /**
     * 覆盖父类的验证,直接pass
     * @param token
     * @param info
     */
    @Override
    protected void assertCredentialsMatch(AuthenticationToken token, AuthenticationInfo info) throws AuthenticationException {
    }

    public SimpleAuthorizingRealm() {
        this(null, null);
    }

    public SimpleAuthorizingRealm(CacheManager cacheManager, CredentialsMatcher matcher) {
        super(cacheManager, matcher);
        setAuthenticationTokenClass(SimpleShiroToken.class);
    }

    public SimpleAuthorizingRealm(CacheManager cacheManager) {
        this(cacheManager, null);
    }

    public SimpleAuthorizingRealm(CredentialsMatcher matcher) {
        this(null, matcher);
    }

    public Dao dao() {
        if (dao == null) {
            dao = Mvcs.ctx().getDefaultIoc().get(Dao.class, "dao");
            return dao;
        }
        return dao;
    }

    public void setDao(Dao dao) {
        this.dao = dao;
    }

    public UserOpService getUserOpService() {
        if(userOpService==null){
            userOpService = Mvcs.ctx().getDefaultIoc().get(UserOpService.class);
        }
        return userOpService;
    }

    public void setUserOpService(UserOpService userOpService) {
        this.userOpService = userOpService;
    }

}
    

入口方法：

@At
    @Ok("jsp:admin-unit")
    public Object findAllDepartment(HttpServletRequest resq){
        NutMap re = new NutMap();
        List<Department> departments =  deptOpService.findAllDepartment();
        re.setv("unitList", departments).setv("dataCount", departments.size());
        return re;
    }

查看页面控制台的时候方法已经调用了，但是页面却没有跳转。。。