阅读源码有助于陶冶情操，本文旨在简单的分析shiro在Spring中的使用
简单介绍
Shiro是一个强大易用的Java安全框架，提供了认证、授权、加密和会话管理等功能
AuthorizingRealm的继承关系
Realm->CachingRealm->AuthenticatingRealm->AuthorizingRealm
本文只针对以上关系进行讲解，其余的实现类请自行查看源码
Realm接口类
Realm提供了安全的访问应用的相关实体类，比如用户、角色、权限，对其中的访问应用相应的认证或者授权操作。其提供的主要的方法为AuthenticationInfo#getAuthenticationInfo，涉及的内容是关于信息的认证，这主要由AuthencatingRealm类实现
CachingRealm抽象类
提供缓存功能，简单看下其下的变量以及主要方法。
- 相关变量如下
//设置是否允许缓存，构造函数中默认为true
private boolean cachingEnabled;
//设置缓存管理器，需要另外引入
private CacheManager cacheManager;
- 主要方法
- CachingRealm#afterCacheManagerSet
默认实现为空，供子类调用，在设置cacheManager变量调用此方法 - CachingRealm#getAvailablePrincipal
//获取principal对象，一般都是子类在执行授权操作赋予的
protected Object getAvailablePrincipal(PrincipalCollection principals) {
Object primary = null;
if (!CollectionUtils.isEmpty(principals)) {
Collection thisPrincipals = principals.fromRealm(getName());
if (!CollectionUtils.isEmpty(thisPrincipals)) {
primary = thisPrincipals.iterator().next();
} else {
//no principals attributed to this particular realm. Fall back to the 'master' primary:
primary = principals.getPrimaryPrincipal();
}
}
return primary;
}
AuthenticatingRealm-验证Realm抽象类
简单分析下其主要私有变量以及方法
- 主要参数
//与父类的cachingEnabled结合使用，在构造函数里其默认是false
private boolean authenticationCachingEnabled;
//用户凭证验证类，比如校验密码是否一致
private CredentialsMatcher credentialsMatcher;
//认证Token类，默认为UsernamePasswordToken类
private Class<? extends AuthenticationToken> authenticationTokenClass;
- 主要方法
- AuthenticatingRealm#setAuthenticationCachingEnabled-设置缓存是否许可
//可见如果只设置authenticationCachingEnable，其为true，也会设置cachingEnable=true
public void setAuthenticationCachingEnabled(boolean authenticationCachingEnabled) {
this.authenticationCachingEnabled = authenticationCachingEnabled;
if (authenticationCachingEnabled) {
setCachingEnabled(true);
}
}
- AuthenticatingRealm#isAuthenticationCachingEnabled
//可见是否应用缓存是根据authenticationCachingEnabled和cachingEnabled联合判断的
public boolean isAuthenticationCachingEnabled() {
return this.authenticationCachingEnabled && isCachingEnabled();
}
- AuthenticatingRealm#getAuthenticationInfo
认证接口实现方法，该方法的回调一般是通过subject.login(token)方法来实现的
public final AuthenticationInfo getAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
//获取缓存中的认证信息，其中也会涉及到调用isAuthenticationCachingEnabled
AuthenticationInfo info = getCachedAuthenticationInfo(token);
if (info == null) {
//otherwise not cached, perform the lookup:
//调用doGetAuthenticationInfo方法，此处为抽象类，供子类调用
info = doGetAuthenticationInfo(token);
log.debug("Looked up AuthenticationInfo [{}] from doGetAuthenticationInfo", info);
if (token != null && info != null) {
cacheAuthenticationInfoIfPossible(token, info);
}
} else {
log.debug("Using cached authentication info [{}] to perform credentials matching.", info);
}
if (info != null) {
//对获取的认证信息进行校验，一般是比对凭证加密后是否还一致
assertCredentialsMatch(token, info);
} else {
log.debug("No AuthenticationInfo found for submitted AuthenticationToken [{}]. Returning null.", token);
}
return info;
}
- AuthenticatingRealm#doGetAuthenticationInfo
获取认证信息方法，抽象方法供子类实现
protected abstract AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException ;
- AuthenticatingRealm#assertCredentialsMatch
对凭证信息的校验，涉及到加密方式
protected void assertCredentialsMatch(AuthenticationToken token, AuthenticationInfo info) throws AuthenticationException {
//获取私有属性credentialsMatcher
CredentialsMatcher cm = getCredentialsMatcher();
if (cm != null) {
//校验方法
if (!cm.doCredentialsMatch(token, info)) {
//not successful - throw an exception to indicate this:
String msg = "Submitted credentials for token [" + token + "] did not match the expected credentials.";
throw new IncorrectCredentialsException(msg);
}
} else {
//可见credentialsMatcher属性必须要设定，否则会抛异常
throw new AuthenticationException("A CredentialsMatcher must be configured in order to verify " +
"credentials during authentication. If you do not wish for credentials to be examined, you " +
"can configure an " + AllowAllCredentialsMatcher.class.getName() + " instance.");
}
}
AuthorizingRealm-授权抽象类
其中的内容和其父类验证抽象类基本相似，这里就不赘述了，主要提下主要方法
- AuthorizingRealm#getAuthorizationInfo
//授权
protected AuthorizationInfo getAuthorizationInfo(PrincipalCollection principals) {
if (principals == null) {
return null;
}
AuthorizationInfo info = null;
if (log.isTraceEnabled()) {
log.trace("Retrieving AuthorizationInfo for principals [" + principals + "]");
}
//是否引用cache
Cache<Object, AuthorizationInfo> cache = getAvailableAuthorizationCache();
if (cache != null) {
if (log.isTraceEnabled()) {
log.trace("Attempting to retrieve the AuthorizationInfo from cache.");
}
Object key = getAuthorizationCacheKey(principals);
info = cache.get(key);
if (log.isTraceEnabled()) {
if (info == null) {
log.trace("No AuthorizationInfo found in cache for principals [" + principals + "]");
} else {
log.trace("AuthorizationInfo found in cache for principals [" + principals + "]");
}
}
}
if (info == null) {
// Call template method if the info was not found in a cache
//调用授权抽象方法，供子类实现
info = doGetAuthorizationInfo(principals);
// If the info is not null and the cache has been created, then cache the authorization info.
if (info != null && cache != null) {
if (log.isTraceEnabled()) {
log.trace("Caching authorization info for principals: [" + principals + "].");
}
Object key = getAuthorizationCacheKey(principals);
cache.put(key, info);
}
}
return info;
}
- AuthorizingRealm#doGetAuthorizationInfo
真实授权抽象方法，供子类调用
protected abstract AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals);
示例
下述示例结合了授权与验证，即继承AuthorizingRealm即可
- spring-shiro配置文件样例
<!--缓存管理器-->
<bean id="cacheManager" class="org.apache.shiro.cache.MemoryConstrainedCacheManager"></bean>
<!-- 凭证匹配器 -->
<bean id="credentialsMatcher" class="com.jing.test.cas.admin.core.shiro.RetryLimitHashedCredentialsMatcher">
<constructor-arg ref="cacheManager"/>
<property name="hashAlgorithmName" value="md5"/>
<property name="hashIterations" value="2"/>
<property name="storedCredentialsHexEncoded" value="true"/>
</bean>
<!--密码处理类-->
<bean id="passwordService" class="com.jing.test.cas.admin.core.shiro.ShiroPasswordService"></bean>
<!-- Realm实现 -->
<bean id="shiroDBRealm" class="com.jing.test.cas.admin.core.shiro.ShiroDBRealm">
<property name="credentialsMatcher" ref="credentialsMatcher"/>
<property name="cachingEnabled" value="false"/>
<property name="shiroPasswordService" ref="passwordService"/>
<property name="shiroUserService" ref="shiroUserService"/>
</bean>
<!-- 安全管理器 -->
<bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
<property name="realm" ref="shiroDBRealm"/>
<property name="sessionManager" ref="sessionManager"/>
</bean>
<!-- 相当于调用SecurityUtils.setSecurityManager(securityManager) -->
<bean class="org.springframework.beans.factory.config.MethodInvokingFactoryBean">
<property name="staticMethod" value="org.apache.shiro.SecurityUtils.setSecurityManager"/>
<property name="arguments" ref="securityManager"/>
</bean>
<!-- Shiro的Web过滤器 -->
<bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
<property name="securityManager" ref="securityManager"/>
<property name="loginUrl" value="/login"/>
<property name="successUrl" value="/index.html"/>
<property name="unauthorizedUrl" value="/403.html"/>
<property name="filters">
<util:map>
<entry key="authc" value-ref="formAuthenticationFilter"/>
<entry key="perm" value-ref="permissionsAuthorizationFilter"/>
<entry key="captcha" value-ref="captchaValidateFilter"/>
<entry key="sysUser" value-ref="sysUserFilter"/>
<entry key="user" value-ref="userFilter"/>
</util:map>
</property>
<property name="filterChainDefinitions">
<!-- 如果不应用acm cas方案则添加 /logout=logout -->
<value>
/ossmanager/api/** = anon
/test/** = anon
/login = captcha,authc
/logout=logout
/index = anon
/jcaptcha.jpeg = anon
/403.html = anon
/login.html = anon
/favicon.ico = anon
/static/** = anon
/index.html=user,sysUser
/welcome.html=user,sysUser
/admin/user/modifyPwd.html=user,sysUser
/admin/user/updatePassword=user,sysUser
/admin/user/role/list=user,sysUser
/** = user,sysUser,perm
</value>
</property>
</bean>
<!-- Shiro生命周期处理器-->
<bean id="lifecycleBeanPostProcessor" class="org.apache.shiro.spring.LifecycleBeanPostProcessor"/>
- Realm接口实现类
package com.jing.test.cas.admin.core.shiro;
import com.jing.test.cas.admin.core.exceptions.BizException;
import org.apache.commons.lang3.ArrayUtils;
import org.apache.commons.lang3.StringUtils;
import org.apache.shiro.SecurityUtils;
import org.apache.shiro.authc.*;
import org.apache.shiro.authc.credential.HashedCredentialsMatcher;
import org.apache.shiro.authz.AuthorizationInfo;
import org.apache.shiro.authz.SimpleAuthorizationInfo;
import org.apache.shiro.realm.AuthorizingRealm;
import org.apache.shiro.subject.PrincipalCollection;
import org.apache.shiro.util.ByteSource;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import java.util.Collections;
import java.util.Set;
/**
*Realm接口实现类
*/
public class ShiroDBRealm extends AuthorizingRealm {
/**
* 日志对象
*/
private static final Logger logger = LoggerFactory.getLogger(ShiroDBRealm.class);
/**
* 账户禁用
*/
private static final String USER_STATUS_FORBIDDEN = "1";
/**
* 权限相关用户服务接口
*/
private IShiroUserService shiroUserService;
/**
* 密码服务类 加密作用
*/
private ShiroPasswordService shiroPasswordService;
/**
* 授权
* @param principalCollection
* @return
*/
@Override
protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {
// 因为非正常退出，即没有显式调用 SecurityUtils.getSubject().logout()
// (可能是关闭浏览器，或超时)，但此时缓存依旧存在(principals)，所以会自己跑到授权方法里。
if (!SecurityUtils.getSubject().isAuthenticated()) {
doClearCache(principalCollection);
SecurityUtils.getSubject().logout();
return null;
}
ShiroUser shiroUser = (ShiroUser)principalCollection.getPrimaryPrincipal();
String userName = shiroUser.getUserName();
if(StringUtils.isNotBlank(userName)){
SimpleAuthorizationInfo sazi = new SimpleAuthorizationInfo();
try {
Set<String> roleIds= shiroUserService.getRoles(userName);
for (String roleId: roleIds){
shiroUser.setRoleId(roleId);
}
sazi.addRoles(roleIds);
sazi.addStringPermissions(shiroUserService.getPermissions(userName));
return sazi;
} catch (Exception e) {
logger.error(e.getMessage(),e);
}
}
return null;
}
/**
* 认证
* @param authenticationToken
* @return
* @throws AuthenticationException
*/
@Override
protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken) throws AuthenticationException {
UsernamePasswordToken token = (UsernamePasswordToken) authenticationToken;
ShiroUser shiroUser = shiroUserService.getShiroUser(token.getUsername());
checkUserStatus(shiroUser);
if(shiroUser != null){
SimpleAuthenticationInfo authenticationInfo = new SimpleAuthenticationInfo(shiroUser,shiroUser.getPassword(),ByteSource.Util.bytes(shiroUser.getUserName()+shiroPasswordService.getPublicSalt()),getName());
return authenticationInfo;
}
return null;
}
/**
* 检查用户状态
* @param shiroUser
*/
private void checkUserStatus(ShiroUser shiroUser) {
if(StringUtils.equalsIgnoreCase(shiroUser.getUserStatus(),USER_STATUS_FORBIDDEN)){
throw new ForbiddenException("用户已被禁用");
}
}
/**
* 初始化方法
* 设定Password校验的Hash算法与迭代次数.
**/
public void initCredentialsMatcher() {
HashedCredentialsMatcher matcher = new HashedCredentialsMatcher(
shiroPasswordService.getHashAlgorithm());
matcher.setHashIterations(shiroPasswordService.getHashInterations());
setCredentialsMatcher(matcher);
}
public void setShiroUserService(IShiroUserService shiroUserService) {
this.shiroUserService = shiroUserService;
}
public void setShiroPasswordService(ShiroPasswordService shiroPasswordService) {
this.shiroPasswordService = shiroPasswordService;
}
}
总结
授权与验证的逻辑做了简单的了解，其中授权可通过subject.isPermited()等方法调用；验证则可通过subject.login()等方法来调用