Mailing-List: contact user-help@shiro.apache.org; run by ezmlm
Precedence: bulk
Reply-To: user@shiro.apache.org
Received-SPF: neutral (athena.apache.org: 209.85.160.173 is neither permitted
 nor denied by domain of bcarr@spredfast.com)
From: "Brian M. Carr" <bcarr@spredfast.com>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: quoted-printable
Subject: @RequiresRoles interception on class
Date: Mon, 16 Jan 2012 10:15:47 -0600
Message-Id: <A0DCE905-51ED-482F-9A54-4C3F4F7CD487@spredfast.com>
To: user@shiro.apache.org
Mime-Version: 1.0 (Apple Message framework v1251.1)

Hello all,

I'm working with Shiro 1.1.0 and have a project with a custom realm.  =
When I add a @RequiresRoles("admin") annotation to a method in a =
controller, Shiro correctly intercepts the request, and throws an =
expected AuthorizationEception.  However, when I move the annotation up =
to the class level, users lacking the "admin" role are granted access =
without an exception.

The @RequiresRoles annotation has TYPE in it's target, so I was =
expecting this to work.  Is this functionality currently available?  If =
it is available, is there additional configuration necessary to cause =
Shiro to intercept all method calls in a class beyond what is needed to =
intercept annotated methods?

Thank you,
--b