title: Shiro Authorization Permission check using Annotation not working
body: <p>Platform: Shiro 1.1.0, Spring 3.0.5</p>
  
  <p>I'm trying to secure the MVC Controller methods using Shiro annotation. However something is wrong with annotations. Regular calls are just working OK. There is nothing specific in Shiro debug also. </p>
  
  <p>My shiro configuration:</p>
  
  <pre><code>&lt;!-- Security Manager --&gt;
      &lt;bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager"&gt;
          &lt;property name="sessionMode" value="native" /&gt;
          &lt;property name="realm" ref="jdbcRealm" /&gt;
          &lt;property name="cacheManager" ref="cacheManager"/&gt;
      &lt;/bean&gt;
  
      &lt;!-- Caching --&gt;
      &lt;bean id="cacheManager" class="org.apache.shiro.cache.ehcache.EhCacheManager"&gt;
          &lt;property name="cacheManager" ref="ehCacheManager" /&gt;
      &lt;/bean&gt;
  
      &lt;bean id="ehCacheManager"
          class="org.springframework.cache.ehcache.EhCacheManagerFactoryBean" /&gt;
  
      &lt;bean id="sessionDAO"
          class="org.apache.shiro.session.mgt.eis.EnterpriseCacheSessionDAO" /&gt;
  
      &lt;bean id="sessionManager"
          class="org.apache.shiro.web.session.mgt.DefaultWebSessionManager"&gt;
          &lt;property name="sessionDAO" ref="sessionDAO" /&gt;
      &lt;/bean&gt;
  
  
      &lt;!-- JDBC Realm Settings --&gt;
      &lt;bean id="jdbcRealm" class="org.apache.shiro.realm.jdbc.JdbcRealm"&gt;
          &lt;property name="name" value="jdbcRealm" /&gt;
          &lt;property name="dataSource" ref="dataSource" /&gt;
          &lt;property name="authenticationQuery"
              value="SELECT password FROM system_user_accounts WHERE username=? and status=1" /&gt;
          &lt;property name="userRolesQuery"
              value="SELECT role_name FROM system_roles r, system_user_accounts u, system_user_roles ur WHERE u.user_id=ur.user_id AND r.role_id=ur.role_id AND u.username=?" /&gt;
          &lt;property name="permissionsQuery"
              value="SELECT permission_name FROM system_roles r, system_permissions p, system_role_permission rp WHERE r.role_id=rp.role_id AND p.permission_id=rp.permission_id AND r.role_name=?" /&gt;
          &lt;property name="permissionsLookupEnabled" value="true"&gt;&lt;/property&gt;
      &lt;/bean&gt;
  
      &lt;!-- Spring Integration --&gt;
      &lt;bean id="lifecycleBeanPostProcessor" class="org.apache.shiro.spring.LifecycleBeanPostProcessor" /&gt;
  
      &lt;!-- Enable Shiro Annotations for Spring-configured beans. Only run after 
          the lifecycleBeanProcessor has run: --&gt;
      &lt;bean id="annotationProxy"
          class="org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator"
          depends-on="lifecycleBeanPostProcessor" /&gt;
      &lt;bean
          class="org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor"&gt;
          &lt;property name="securityManager" ref="securityManager" /&gt;
      &lt;/bean&gt;
  
      &lt;!-- Secure Spring remoting: Ensure any Spring Remoting method invocations 
          can be associated with a Subject for security checks. --&gt;
      &lt;bean id="secureRemoteInvocationExecutor"
          class="org.apache.shiro.spring.remoting.SecureRemoteInvocationExecutor"&gt;
          &lt;property name="securityManager" ref="securityManager" /&gt;
      &lt;/bean&gt;
  
      &lt;!-- Shiro filter --&gt;
      &lt;bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean"&gt;
          &lt;property name="securityManager" ref="securityManager" /&gt;
          &lt;property name="loginUrl" value="/login" /&gt;
          &lt;property name="successUrl" value="/dashboard" /&gt;
          &lt;property name="unauthorizedUrl" value="/error" /&gt;
          &lt;property name="filterChainDefinitions"&gt;
              &lt;value&gt; 
                  &lt;!-- !!! Order matters !!! --&gt;
                  /authenticate = anon
                  /login = anon
                  /logout = anon
                  /error = anon
                  /** = authc
              &lt;/value&gt;
          &lt;/property&gt;
      &lt;/bean&gt;
  </code></pre>
  
  <p>I can get the following working correctly:</p>
  
  <pre><code>@RequestMapping(value="/form") 
  public String viewPatientForm(Model model, @RequestParam(value="patientId", required=false) Long patientId){    
     if (!SecurityUtils.getSubject().isPermitted("hc:viewPatient")){
        logger.error("Operation not permitted");
        throw new AuthorizationException("No Permission"); 
     }
  }
  </code></pre>
  
  <p>But the below doesn't work:</p>
  
  <pre><code>@RequiresPermissions("hc:patientView")
      @RequestMapping(value="/form")
      public String viewPatientForm(Model model, @RequestParam(value="patientId", required=false) Long patientId){    
  </code></pre>
  
  <p>Am I missing something? Please help.</p>