Shiro官方快速入門10min例子原始碼解析框架3-Authentication(身份認證)
在作完預備的初始化和session測試後，到了作為一個權鑑別框架的核心功能部分，確認你是誰--身份認證（Authentication）。
通過提交給shiro身份資訊來驗證是否與儲存的安全資訊資料是否相符來判斷使用者身份的真實性
本文涉及到token的構建，框架結構下認證行為的呼叫，realm中授權資料的獲取、登入資訊比較，login過程中對已有有subject、session的處理
同樣，本篇本文使用的是shiro 1.3.2版本，配合原始碼最佳~
官方例子程式碼流程如下
if (!currentUser.isAuthenticated()) {
UsernamePasswordToken token = new UsernamePasswordToken("lonestarr", "vespa");
token.setRememberMe(true);
try {
currentUser.login(token);
} catch (UnknownAccountException uae) {
log.info("There is no user with username of " + token.getPrincipal());
} catch (IncorrectCredentialsException ice) {
log.info("Password for account " + token.getPrincipal() + " was incorrect!");
} catch (LockedAccountException lae) {
log.info("The account for username " + token.getPrincipal() + " is locked." +
"Please contact your administrator to unlock it.");
}
// ... catch more exceptions here (maybe custom ones specific to your application?
catch (AuthenticationException ae) {
//unexpected condition?error?
}
}
3.1首先 構造token ,其中 UsernamePasswordToken 實現了HostAuthenticationToken和RememberMeAuthenticationToken介面，他們都繼承自AuthenticationToken介面
HostAuthenticationToken介面指定了token的域，RememberMeAuthenticationToken介面指定了token是否實現RememberMe（認證跨session）
ps:shiro 認證狀態區分Authenticated和Remembered，Authenticated指當前session（或流程）下已經過認證，Remembered指曾經獲得認證，如果是web狀態下RememberMe相關資訊儲存在cookie中
二者可以呼叫 subject.isAuthenticated() 及subject.isRemembered()區分
其中UsernamePasswordToken 的Principal(身份)概念即Username，Credentials(憑證)概念即Password
在token 中設定使用者名稱和密碼
UsernamePasswordToken token = new UsernamePasswordToken("lonestarr", "vespa");
設定是否使用RememberMe（此案例中不具體起作用，只是作為示例在token中設定
token.setRememberMe(true);
案例中不對host進行設定
3.2完成對token的構建設定後，便進行 認證(Authentication) 操作
currentUser.login(token);
首先先借用官方的例圖來了解一下整個的流程
1-呼叫subject的login入口傳入token
2-subject實際呼叫SecurityManager的login
3-securityManager再呼叫 authenticator例項的doAuthenticate方法,一般這個是ModularRealmAuthenticator的例項
4-判斷realm的狀況，如果是單realm則直接呼叫realm,如果是多realm則要判斷認證策略（ AuthenticationStrategy ）
5-呼叫對應realm中的getAuthenticationInfo實現進行認證
DelegatingSubject.login程式碼如下，下面對認證流程進行詳細的解讀
public void login(AuthenticationToken token) throws AuthenticationException {
clearRunAsIdentitiesInternal();
Subject subject = securityManager.login(this, token);
PrincipalCollection principals;
String host = null;
if (subject instanceof DelegatingSubject) {
DelegatingSubject delegating = (DelegatingSubject) subject;
//we have to do this in case there are assumed identities - we don't want to lose the 'real' principals:
principals = delegating.principals;
host = delegating.host;
} else {
principals = subject.getPrincipals();
}
if (principals == null || principals.isEmpty()) {
String msg = "Principals returned from securityManager.login( token ) returned a null or " +
"empty value.This value must be non null and populated with one or more elements.";
throw new IllegalStateException(msg);
}
this.principals = principals;
this.authenticated = true;
if (token instanceof HostAuthenticationToken) {
host = ((HostAuthenticationToken) token).getHost();
}
if (host != null) {
this.host = host;
}
Session session = subject.getSession(false);
if (session != null) {
this.session = decorate(session);
} else {
this.session = null;
}
}
3.2.1首先是初始化
clearRunAsIdentitiesInternal();
如果subject已含session則獲取session並清除其中引數
3.2.2呼叫securityManager中的()login()開始認證
Subject subject = securityManager.login(this, token);
這裡呼叫的是DefaultSecurityManager中的login
public Subject login(Subject subject, AuthenticationToken token) throws AuthenticationException {
AuthenticationInfo info;
try {
info = authenticate(token);//呼叫AbstractAuthenticator.authenticate，
} catch (AuthenticationException ae) {
try {
onFailedLogin(token, ae, subject);//認證失敗，清除remenberMe的資訊使之失效
} catch (Exception e) {
if (log.isInfoEnabled()) {
log.info("onFailedLogin method threw an " +
"exception.Logging and propagating original AuthenticationException.", e);
}
}
throw ae; //propagate
}
Subject loggedIn = createSubject(token, info, subject);
onSuccessfulLogin(token, info, loggedIn);
return loggedIn;
}
3.2.2.1
呼叫AbstractAuthenticator.authenticate()，其中呼叫ModularRealmAuthenticator.doAuthenticate
protected AuthenticationInfo doAuthenticate(AuthenticationToken authenticationToken) throws AuthenticationException {
assertRealmsConfigured();
Collection<Realm> realms = getRealms();
if (realms.size() == 1) {
return doSingleRealmAuthentication(realms.iterator().next(), authenticationToken);
} else {
return doMultiRealmAuthentication(realms, authenticationToken);
}
}
判斷realms可用由於是配置的是單realm
則呼叫ModularRealmAuthenticator.doSingleRealmAuthentication(),其中呼叫realm實現判斷token型別是否支援，然後執行realm實現中的getAuthenticationInfo方法
protected AuthenticationInfo doSingleRealmAuthentication(Realm realm, AuthenticationToken token) {
if (!realm.supports(token)) {
String msg = "Realm [" + realm + "] does not support authentication token [" +
token + "].Please ensure that the appropriate Realm implementation is " +
"configured correctly or that the realm accepts AuthenticationTokens of this type.";
throw new UnsupportedTokenException(msg);
}
AuthenticationInfo info = realm.getAuthenticationInfo(token);
if (info == null) {
String msg = "Realm [" + realm + "] was unable to find account data for the " +
"submitted AuthenticationToken [" + token + "].";
throw new UnknownAccountException(msg);
}
return info;
}
從下圖中看出這裡的realm是配置後的iniRealm例項，其方法在AuthenticatingRealm中實現，由於inirealm直接在初始化onInit()時就在記憶體載入了所有授權資料資訊,例子並沒有使用cache。
public final AuthenticationInfo getAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
AuthenticationInfo info = getCachedAuthenticationInfo(token);
if (info == null) {
//otherwise not cached, perform the lookup:
info = doGetAuthenticationInfo(token);
log.debug("Looked up AuthenticationInfo [{}] from doGetAuthenticationInfo", info);
if (token != null && info != null) {
cacheAuthenticationInfoIfPossible(token, info);
}
} else {
log.debug("Using cached authentication info [{}] to perform credentials matching.", info);
}
if (info != null) {
assertCredentialsMatch(token, info);
} else {
log.debug("No AuthenticationInfo found for submitted AuthenticationToken [{}].Returning null.", token);
}
return info;
}
3.2.2.1.1呼叫SimpleAccountRealm.doGetAuthenticationInfo通過使用者名稱從Map users 取出對應的SimpleAccount，並判斷是否被鎖，是否過期
protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
UsernamePasswordToken upToken = (UsernamePasswordToken) token;
SimpleAccount account = getUser(upToken.getUsername());
if (account != null) {
if (account.isLocked()) {
throw new LockedAccountException("Account [" + account + "] is locked.");
}
if (account.isCredentialsExpired()) {
String msg = "The credentials for account [" + account + "] are expired";
throw new ExpiredCredentialsException(msg);
}
}
return account;
}
對應getUser方法使用了讀鎖保證了map讀操作的原子性
protected SimpleAccount getUser(String username) {
USERS_LOCK.readLock().lock();
try {
return this.users.get(username);
} finally {
USERS_LOCK.readLock().unlock();
}
}
3.2.2.1.2呼叫AuthenticatingRealm.assertCredentialsMatch，獲取密碼比較器（ CredentialsMatcher ），其中呼叫doCredentialsMatch獲取對比token和info（上面從realm通過使用者名稱獲取的AuthenticationInfo例項）中的密碼（核心的一步），並返回結果
public boolean doCredentialsMatch(AuthenticationToken token, AuthenticationInfo info) {
Object tokenCredentials = getCredentials(token);
Object accountCredentials = getCredentials(info);
return equals(tokenCredentials, accountCredentials);
}
3.2.2.2隨後通知認證監聽器AuthenticationListener（本例未設定）層層返回info至DefaultSecurityManager建立新的有登入資訊的subject
Subject loggedIn = createSubject(token, info, subject);
並將現有subject中的資訊賦予新的subject
protected Subject createSubject(AuthenticationToken token, AuthenticationInfo info, Subject existing) {
SubjectContext context = createSubjectContext();
context.setAuthenticated(true);
context.setAuthenticationToken(token);
context.setAuthenticationInfo(info);
if (existing != null) {
context.setSubject(existing);
}
return createSubject(context);
}
3.2.2.3設定rememberMe（本例未實現
onSuccessfulLogin(token, info, loggedIn);
3.2.3 繼續獲取資訊principals,host(本例無),設定session到subject，
if (subject instanceof DelegatingSubject) {
DelegatingSubject delegating = (DelegatingSubject) subject;
//we have to do this in case there are assumed identities - we don't want to lose the 'real' principals:
principals = delegating.principals;
host = delegating.host;
} else {
principals = subject.getPrincipals();
}
if (principals == null || principals.isEmpty()) {
String msg = "Principals returned from securityManager.login( token ) returned a null or " +
"empty value.This value must be non null and populated with one or more elements.";
throw new IllegalStateException(msg);
}
this.principals = principals;
this.authenticated = true;
if (token instanceof HostAuthenticationToken) {
host = ((HostAuthenticationToken) token).getHost();
}
if (host != null) {
this.host = host;
}
Session session = subject.getSession(false);
if (session != null) {
this.session = decorate(session);
} else {
this.session = null;
}
3.3完成認證後測試一下Principal(使用者名稱)是否正確
log.info("User [" + currentUser.getPrincipal() + "] logged in successfully.");
可見使用者資訊正確
至此完成了一個簡單的Authentication過程
參考：
http://shiro.apache.org/10-minute-tutorial.html
http://shiro.apache.org/authentication.html
http://www.apache.org/dyn/closer.cgi/shiro/1.3.2/shiro-root-1.3.2-source-release.zip
轉載請註明作者及來源： https://www.cnblogs.com/codflow/