Shiro authorization process

①. The application or framework code calls any Subject’s hasRole*, checkRole*, isPermitted*, or variants of the


checkPermission method, passing any required permissions   . ②. An instance of Subject—usually DelegatingSubject (or subclass), calling securityManager the corresponding method.    ③. org.apache.shiro.authz.Authorizer the SecurityManager interface call the corresponding methods. By default, the Authorizer ModularRealmAuthorizer an example, which supports a coordinated operation of the authorization process of any one or more instances Realm   ④ Each configured Realm is checked to see if it implements the same Authorizer interface. If so, the respective hasRole , checkRole*, isPermitted*, or checkPermission* methods of the Realm will be called.