1. shiro介紹

Apache Shiro是一個(gè)強(qiáng)大易用的Java安全框架，提供了認(rèn)證、授權(quán)、加密和會話管理等功能：?

• 認(rèn)證 - 用戶身份識別，常被稱為用戶“登錄”；
• 授權(quán) - 訪問控制；
• 密碼加密 - 保護(hù)或隱藏?cái)?shù)據(jù)防止被偷窺；
• 會話管理 - 每用戶相關(guān)的時(shí)間敏感的狀態(tài)。

對于任何一個(gè)應(yīng)用程序，Shiro都可以提供全面的安全管理服務(wù)。并且相對于其他安全框架，Shiro要簡單的多。

2. shiro源碼概況

? ? 先要了解shiro的基本框架(見http://www.cnblogs.com/davidwang456/p/4425145.html)。

? ? 然后看一下各個(gè)組件之間的關(guān)系：

一下內(nèi)容參考：http://kdboy.iteye.com/blog/1154644

Subject：即“當(dāng)前操作用戶”。但是，在Shiro中，Subject這一概念并不僅僅指人，也可以是第三方進(jìn)程、后臺帳戶（Daemon Account）或其他類似事物。它僅僅意味著“當(dāng)前跟軟件交互的東西”。但考慮到大多數(shù)目的和用途，你可以把它認(rèn)為是Shiro的“用戶”概念。?
Subject代表了當(dāng)前用戶的安全操作，SecurityManager則管理所有用戶的安全操作。?

SecurityManager：它是Shiro框架的核心，典型的Facade模式，Shiro通過SecurityManager來管理內(nèi)部組件實(shí)例，并通過它來提供安全管理的各種服務(wù)。?

Realm： Realm充當(dāng)了Shiro與應(yīng)用安全數(shù)據(jù)間的“橋梁”或者“連接器”。也就是說，當(dāng)對用戶執(zhí)行認(rèn)證（登錄）和授權(quán)（訪問控制）驗(yàn)證時(shí)，Shiro會從應(yīng)用配置的Realm中查找用戶及其權(quán)限信息。?
從這個(gè)意義上講，Realm實(shí)質(zhì)上是一個(gè)安全相關(guān)的DAO：它封裝了數(shù)據(jù)源的連接細(xì)節(jié)，并在需要時(shí)將相關(guān)數(shù)據(jù)提供給Shiro。當(dāng)配置Shiro時(shí)，你必須至少指定一個(gè)Realm，用于認(rèn)證和（或）授權(quán)。配置多個(gè)Realm是可以的，但是至少需要一個(gè)。?
Shiro內(nèi)置了可以連接大量安全數(shù)據(jù)源（又名目錄）的Realm，如LDAP、關(guān)系數(shù)據(jù)庫（JDBC）、類似INI的文本配置資源以及屬性文件等。如果缺省的Realm不能滿足需求，你還可以插入代表自定義數(shù)據(jù)源的自己的Realm實(shí)現(xiàn)。

Shiro主要組件還包括：?
Authenticator ：認(rèn)證就是核實(shí)用戶身份的過程。這個(gè)過程的常見例子是大家都熟悉的“用戶/密碼”組合。多數(shù)用戶在登錄軟件系統(tǒng)時(shí)，通常提供自己的用戶名（當(dāng)事人）和支持他們的密碼（證書）。如果存儲在系統(tǒng)中的密碼（或密碼表示）與用戶提供的匹配，他們就被認(rèn)為通過認(rèn)證。?
Authorizer ：授權(quán)實(shí)質(zhì)上就是訪問控制 - 控制用戶能夠訪問應(yīng)用中的哪些內(nèi)容，比如資源、Web頁面等等。?
SessionManager ：在安全框架領(lǐng)域，Apache Shiro提供了一些獨(dú)特的東西：可在任何應(yīng)用或架構(gòu)層一致地使用Session API。即，Shiro為任何應(yīng)用提供了一個(gè)會話編程范式 - 從小型后臺獨(dú)立應(yīng)用到大型集群Web應(yīng)用。這意味著，那些希望使用會話的應(yīng)用開發(fā)者，不必被迫使用Servlet或EJB容器了。或者，如果正在使用這些容器，開發(fā)者現(xiàn)在也可以選擇使用在任何層統(tǒng)一一致的會話API，取代Servlet或EJB機(jī)制。?
CacheManager :對Shiro的其他組件提供緩存支持。?

3. 做一個(gè)demo，跑shiro的源碼，從login開始：

第一步：用戶根據(jù)表單信息填寫用戶名和密碼，然后調(diào)用登陸按鈕。內(nèi)部執(zhí)行如下：

UsernamePasswordToken token = new UsernamePasswordToken(loginForm.getUsername(), loginForm.getPassphrase()); token.setRememberMe(true);Subject currentUser = SecurityUtils.getSubject();currentUser.login(token);

第二步：代理DelegatingSubject繼承Subject執(zhí)行l(wèi)ogin

public void login(AuthenticationToken token) throws AuthenticationException {clearRunAsIdentitiesInternal();Subject subject = securityManager.login(this, token);PrincipalCollection principals;String host = null;if (subject instanceof DelegatingSubject) {DelegatingSubject delegating = (DelegatingSubject) subject;//we have to do this in case there are assumed identities - we don't want to lose the 'real' principals:principals = delegating.principals;host = delegating.host;} else {principals = subject.getPrincipals();}if (principals == null || principals.isEmpty()) {String msg = "Principals returned from securityManager.login( token ) returned a null or " +"empty value. This value must be non null and populated with one or more elements.";throw new IllegalStateException(msg);}this.principals = principals;this.authenticated = true;if (token instanceof HostAuthenticationToken) {host = ((HostAuthenticationToken) token).getHost();}if (host != null) {this.host = host;}Session session = subject.getSession(false);if (session != null) {this.session = decorate(session);} else {this.session = null;}}

第三步：調(diào)用DefaultSecurityManager繼承SessionsSecurityManager執(zhí)行l(wèi)ogin方法

public Subject login(Subject subject, AuthenticationToken token) throws AuthenticationException {AuthenticationInfo info;try { info = authenticate(token);} catch (AuthenticationException ae) {try {onFailedLogin(token, ae, subject);} catch (Exception e) {if (log.isInfoEnabled()) {log.info("onFailedLogin method threw an " +"exception. Logging and propagating original AuthenticationException.", e);}}throw ae; //propagate } Subject loggedIn = createSubject(token, info, subject); onSuccessfulLogin(token, info, loggedIn);return loggedIn;}

第四步：認(rèn)證管理器AuthenticatingSecurityManager繼承RealmSecurityManager執(zhí)行authenticate方法：

/*** Delegates to the wrapped {@link org.apache.shiro.authc.Authenticator Authenticator} for authentication.*/public AuthenticationInfo authenticate(AuthenticationToken token) throws AuthenticationException {return this.authenticator.authenticate(token);}

第五步：抽象認(rèn)證管理器AbstractAuthenticator繼承Authenticator, LogoutAware 執(zhí)行authenticate方法：

public final AuthenticationInfo authenticate(AuthenticationToken token) throws AuthenticationException {if (token == null) {throw new IllegalArgumentException("Method argumet (authentication token) cannot be null.");}log.trace("Authentication attempt received for token [{}]", token);AuthenticationInfo info;try { info = doAuthenticate(token);if (info == null) {String msg = "No account information found for authentication token [" + token + "] by this " +"Authenticator instance. Please check that it is configured correctly.";throw new AuthenticationException(msg);}} catch (Throwable t) {AuthenticationException ae = null;if (t instanceof AuthenticationException) {ae = (AuthenticationException) t;}if (ae == null) {//Exception thrown was not an expected AuthenticationException. Therefore it is probably a little more//severe or unexpected. So, wrap in an AuthenticationException, log to warn, and propagate:String msg = "Authentication failed for token submission [" + token + "]. Possible unexpected " +"error? (Typical or expected login exceptions should extend from AuthenticationException).";ae = new AuthenticationException(msg, t);}try {notifyFailure(token, ae);} catch (Throwable t2) {if (log.isWarnEnabled()) {String msg = "Unable to send notification for failed authentication attempt - listener error?. " +"Please check your AuthenticationListener implementation(s). Logging sending exception " +"and propagating original AuthenticationException instead...";log.warn(msg, t2);}}throw ae;}log.debug("Authentication successful for token [{}]. Returned account [{}]", token, info);notifySuccess(token, info);return info;}

第六步：ModularRealmAuthenticator繼承AbstractAuthenticator執(zhí)行doAuthenticate方法

protected AuthenticationInfo doAuthenticate(AuthenticationToken authenticationToken) throws AuthenticationException {assertRealmsConfigured();Collection<Realm> realms = getRealms();if (realms.size() == 1) {return doSingleRealmAuthentication(realms.iterator().next(), authenticationToken);} else {return doMultiRealmAuthentication(realms, authenticationToken);}}

接著調(diào)用：

/*** Performs the authentication attempt by interacting with the single configured realm, which is significantly* simpler than performing multi-realm logic.** @param realm the realm to consult for AuthenticationInfo.* @param token the submitted AuthenticationToken representing the subject's (user's) log-in principals and credentials.* @return the AuthenticationInfo associated with the user account corresponding to the specified {@code token}*/protected AuthenticationInfo doSingleRealmAuthentication(Realm realm, AuthenticationToken token) {if (!realm.supports(token)) {String msg = "Realm [" + realm + "] does not support authentication token [" +token + "]. Please ensure that the appropriate Realm implementation is " +"configured correctly or that the realm accepts AuthenticationTokens of this type.";throw new UnsupportedTokenException(msg);}AuthenticationInfo info = realm.getAuthenticationInfo(token);if (info == null) {String msg = "Realm [" + realm + "] was unable to find account data for the " +"submitted AuthenticationToken [" + token + "].";throw new UnknownAccountException(msg);}return info;}

第七步：AuthenticatingRealm繼承CachingRealm執(zhí)行g(shù)etAuthenticationInfo方法

public final AuthenticationInfo getAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {AuthenticationInfo info = getCachedAuthenticationInfo(token); //從緩存中讀取if (info == null) {//otherwise not cached, perform the lookup:info = doGetAuthenticationInfo(token); //緩存中讀不到，則到數(shù)據(jù)庫或者ldap或者jndi等去讀log.debug("Looked up AuthenticationInfo [{}] from doGetAuthenticationInfo", info);if (token != null && info != null) {cacheAuthenticationInfoIfPossible(token, info);}} else {log.debug("Using cached authentication info [{}] to perform credentials matching.", info);}if (info != null) {assertCredentialsMatch(token, info);} else {log.debug("No AuthenticationInfo found for submitted AuthenticationToken [{}]. Returning null.", token);}return info;}

1. 從緩存中讀取的方法：

/*** Checks to see if the authenticationCache class attribute is null, and if so, attempts to acquire one from* any configured {@link #getCacheManager() cacheManager}. If one is acquired, it is set as the class attribute.* The class attribute is then returned.** @return an available cache instance to be used for authentication caching or {@code null} if one is not available.* @since 1.2*/private Cache<Object, AuthenticationInfo> getAuthenticationCacheLazy() {if (this.authenticationCache == null) {log.trace("No authenticationCache instance set. Checking for a cacheManager...");CacheManager cacheManager = getCacheManager();if (cacheManager != null) {String cacheName = getAuthenticationCacheName();log.debug("CacheManager [{}] configured. Building authentication cache '{}'", cacheManager, cacheName);this.authenticationCache = cacheManager.getCache(cacheName);}}return this.authenticationCache;}

2. 從數(shù)據(jù)庫中讀取的方法：

JdbcRealm繼承 AuthorizingRealm執(zhí)行doGetAuthenticationInfo方法

protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {UsernamePasswordToken upToken = (UsernamePasswordToken) token;String username = upToken.getUsername();// Null username is invalidif (username == null) {throw new AccountException("Null usernames are not allowed by this realm.");}Connection conn = null;SimpleAuthenticationInfo info = null;try {conn = dataSource.getConnection();String password = null;String salt = null;switch (saltStyle) {case NO_SALT:password = getPasswordForUser(conn, username)[0];break;case CRYPT:// TODO: separate password and hash from getPasswordForUser[0]throw new ConfigurationException("Not implemented yet");//break;case COLUMN: String[] queryResults = getPasswordForUser(conn, username);password = queryResults[0];salt = queryResults[1];break;case EXTERNAL:password = getPasswordForUser(conn, username)[0];salt = getSaltForUser(username);}if (password == null) {throw new UnknownAccountException("No account found for user [" + username + "]");}info = new SimpleAuthenticationInfo(username, password.toCharArray(), getName());if (salt != null) {info.setCredentialsSalt(ByteSource.Util.bytes(salt));}} catch (SQLException e) {final String message = "There was a SQL error while authenticating user [" + username + "]";if (log.isErrorEnabled()) {log.error(message, e);}// Rethrow any SQL errors as an authentication exceptionthrow new AuthenticationException(message, e);} finally {JdbcUtils.closeConnection(conn);}return info;}

接著調(diào)用sql語句：

private String[] getPasswordForUser(Connection conn, String username) throws SQLException {String[] result;boolean returningSeparatedSalt = false;switch (saltStyle) {case NO_SALT:case CRYPT:case EXTERNAL:result = new String[1];break;default:result = new String[2];returningSeparatedSalt = true;}PreparedStatement ps = null;ResultSet rs = null;try {ps = conn.prepareStatement(authenticationQuery);ps.setString(1, username);// Execute queryrs = ps.executeQuery();// Loop over results - although we are only expecting one result, since usernames should be uniqueboolean foundResult = false;while (rs.next()) {// Check to ensure only one row is processedif (foundResult) {throw new AuthenticationException("More than one user row found for user [" + username + "]. Usernames must be unique.");}result[0] = rs.getString(1);if (returningSeparatedSalt) {result[1] = rs.getString(2);}foundResult = true;}} finally {JdbcUtils.closeResultSet(rs);JdbcUtils.closeStatement(ps);}return result;}

其中authenticationQuery定義如下：

protected String authenticationQuery = DEFAULT_AUTHENTICATION_QUERY;protected static final String DEFAULT_AUTHENTICATION_QUERY = "select password from users where username = ?";

4. 小結(jié)

Apache Shiro 是功能強(qiáng)大并且容易集成的開源權(quán)限框架，它能夠完成認(rèn)證、授權(quán)、加密、會話管理等功能。認(rèn)證和授權(quán)為權(quán)限控制的核心，簡單來說，“認(rèn)證”就是證明你是誰？ Web 應(yīng)用程序一般做法通過表單提交用戶名及密碼達(dá)到認(rèn)證目的。“授權(quán)”即是否允許已認(rèn)證用戶訪問受保護(hù)資源。

參考文獻(xiàn)：

http://kdboy.iteye.com/blog/1154644

http://www.ibm.com/developerworks/cn/java/j-lo-shiro/?

?

轉(zhuǎn)載于:https://www.cnblogs.com/davidwang456/p/4428421.html

《新程序員》：云原生和全面數(shù)字化實(shí)踐50位技術(shù)專家共同創(chuàng)作，文字、視頻、音頻交互閱讀

總結(jié)

以上是生活随笔為你收集整理的源码分析shiro认证授权流程的全部內(nèi)容，希望文章能夠幫你解決所遇到的問題。

如果覺得生活随笔網(wǎng)站內(nèi)容還不錯(cuò)，歡迎將生活随笔推薦給好友。