Java的Shiro框架认证流程详解

<dependency>
    <groupId>org.apache.shiro</groupId>
    <artifactId>shiro-core</artifactId>
    <version>1.7.1</version>
</dependency>

[users]
zhangsan=123
admin=123456
splay=123456

import org.apache.shiro.SecurityUtils;
import org.apache.shiro.authc.IncorrectCredentialsException;
import org.apache.shiro.authc.UnknownAccountException;
import org.apache.shiro.authc.UsernamePasswordToken;
import org.apache.shiro.mgt.DefaultSecurityManager;
import org.apache.shiro.mgt.SecurityManager;
import org.apache.shiro.realm.text.IniRealm;
import org.apache.shiro.subject.Subject;
public class Application {
    public static void main(String[] args) {
        // 1. 创建安全管理器对象
        DefaultSecurityManager securityManager = new DefaultSecurityManager();
        // 2. 给安全管理器对象设置realm(模拟数据库中的数据)
        securityManager.setRealm(new IniRealm("classpath:shiro.ini"));
        // 3. SecurityUtil设置全局的安全管理器
        SecurityUtils.setSecurityManager(securityManager);
        // 4. 关键对象Subject主体对象
        Subject subject = SecurityUtils.getSubject();
        // 5. 模拟登录（用户名、密码）
        UsernamePasswordToken user = new UsernamePasswordToken("splay", "123456");
        try{
            System.out.println("认证状态: " + subject.isAuthenticated());
            //登录校验
            subject.login(user);
            System.out.println("认证状态: " + subject.isAuthenticated());
        } catch (IncorrectCredentialsException e){
            e.printStackTrace();
            System.out.println("认证失败: 用户名密码错误!");
        } catch (UnknownAccountException e){
            e.printStackTrace();
            System.out.println("认证失败: 用户名错误!");
        }
    }
}

public class SimpleAccountRealm extends AuthorizingRealm {
	protected SimpleAccount getUser(String username) {
	    USERS_LOCK.readLock().lock();				//ReentrantReadWriteLock可重入读写锁
	    try {
	        return this.users.get(username);
	    } finally {
	        USERS_LOCK.readLock().unlock();
	    }
	}
	
	protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token)  {
	    UsernamePasswordToken upToken = (UsernamePasswordToken) token;
	    SimpleAccount account = getUser(upToken.getUsername());
		
	    if (account != null) {				
	        if (account.isLocked()) {		//账户被锁定
	            throw new LockedAccountException("Account [" + account + "] is locked.");
	        }
	        if (account.isCredentialsExpired()) {		//凭证过期
	            String msg = "The credentials for account [" + account + "] are expired";
	            throw new ExpiredCredentialsException(msg);
	        }
	    }
	    return account;
	}
}

public abstract class AuthenticatingRealm extends CachingRealm implements Initializable {

	public final AuthenticationInfo getAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {

        AuthenticationInfo info = getCachedAuthenticationInfo(token);
        if (info == null) {
            //otherwise not cached, perform the lookup:
            info = doGetAuthenticationInfo(token);			//校验账户
            log.debug("Looked up AuthenticationInfo [{}] from doGetAuthenticationInfo", info);
            if (token != null && info != null) {			//操作缓存
                cacheAuthenticationInfoIfPossible(token, info);
            }
        } else {
            log.debug("Using cached authentication info [{}] to perform credentials matching.", info);
        }

        if (info != null) {
            assertCredentialsMatch(token, info);		//见下方
        } else {
            log.debug("No AuthenticationInfo found for submitted AuthenticationToken [{}].  Returning null.", token);
        }

        return info;
    }
    protected void assertCredentialsMatch(AuthenticationToken token, AuthenticationInfo info) throws AuthenticationException {
        CredentialsMatcher cm = getCredentialsMatcher();
        if (cm != null) {
            if (!cm.doCredentialsMatch(token, info)) {
                // 密码错误异常
                String msg = "Submitted credentials for token [" + token + "] did not match the expected credentials.";
                throw new IncorrectCredentialsException(msg);
            }
        } else {
            throw new AuthenticationException("A CredentialsMatcher must be configured in order to verify " +
                    "credentials during authentication.  If you do not wish for credentials to be examined, you " +
                    "can configure an " + AllowAllCredentialsMatcher.class.getName() + " instance.");
        }
    }
}

public class ModularRealmAuthenticator extends AbstractAuthenticator {
	protected AuthenticationInfo doSingleRealmAuthentication(Realm realm, AuthenticationToken token) {
        if (!realm.supports(token)) {
            String msg = "Realm [" + realm + "] does not support authentication token [" +
                    token + "].  Please ensure that the appropriate Realm implementation is " +
                    "configured correctly or that the realm accepts AuthenticationTokens of this type.";
            throw new UnsupportedTokenException(msg);
        }
        AuthenticationInfo info = realm.getAuthenticationInfo(token);
        if (info == null) {
            String msg = "Realm [" + realm + "] was unable to find account data for the " +
                    "submitted AuthenticationToken [" + token + "].";
            throw new UnknownAccountException(msg);			//账户不存在
        }
        return info;
    }
}