Shiro登錄身份認證(從SecurityUtils.getSubject().login(token))到Realm的doGetAuthenticationInfo

ssm框架下,controller接收到登錄請求交給Service並開始處理流程：

1.Service的login方法：

@Service
public class SysUserServiceImpl implements SysUserService {
    @Autowired
    SysUserMapper mapper;

    @Override
    public LoginResult login(SysUser sysUser) {
        LoginResult loginResult = new LoginResult();
        try {    
            List<SysUser> sysUsers = mapper.selectByExample(sysUser.getUsername());
            BackUserToken backUserToken=new BackUserToken(sysUser.getUsername(), sysUser.getPwd(),sysUsers);
            SecurityUtils.getSubject().login(backUserToken);
            loginResult.setStatus(RespMSG.STATUS_SUCCESS);
            loginResult.setMsg(RespMSG.MSG_SUCCESS);
            loginResult.setSysUser(sysUsers.get(0));
            return loginResult;
        } catch (UnknownAccountException e) {
            loginResult.setStatus(RespMSG.STATUS_NON_EXISTENT);
            loginResult.setMsg(RespMSG.MSG_NON_EXISTENT);
            return loginResult;
        } catch (AccountException e) {
            e.printStackTrace();
//            loginResult.setStatus(RespMSG.);
//            loginResult.setMsg(RespMSG.MSG_NON_EXISTENT);
//            return loginResult;
        } catch (DeadlineException e) {
            loginResult.setStatus(RespMSG.STATUS_OVERDUE);
            loginResult.setMsg(RespMSG.MSG_OVERDUE);
            return loginResult;
        } catch (AccountRepeatException e) {
            loginResult.setStatus(RespMSG.STATUS_REPETITION);
            loginResult.setMsg(RespMSG.MSG_REPETITION);
            return loginResult;
        } catch (IncorrectCredentialsException e) {
            loginResult.setStatus(RespMSG.STATUS_WRONG_PWD);
            loginResult.setMsg(RespMSG.MSG_WRONG_PWD);
            return loginResult;
        }
        loginResult.setMsg(RespMSG.MSG_UNKNOW);
        loginResult.setStatus(RespMSG.STATUS_UNKNOW);
        return loginResult;
    }

}

BackUserToken集成了UsernamePasswordToken，主要是構造參數多了一個List<SysUser>.因爲我需要在service中將登錄用戶的詳細

信息返回給客戶端，同時將登錄用戶的信息傳遞給Realm進行登錄驗證。

關鍵方法是：

SecurityUtils.getSubject().login(backUserToken);

其具體實現是：

2.DelegatingSubject implements Subject

public class DelegatingSubject implements Subject {
   public void login(AuthenticationToken token) throws AuthenticationException {
        ...
        Subject subject = this.securityManager.login(this, token);
        ...
    }
}

token繼續傳遞：

3.DefaultSecurityManager

public class DefaultSecurityManager extends SessionsSecurityManager {

    public Subject login(Subject subject, AuthenticationToken token) throws AuthenticationException {
        ...
            info = this.authenticate(token);
	...
        return loggedIn;
    }
   
}

向下繼續

4.AuthenticatingSecurityManager

public abstract class AuthenticatingSecurityManager extends RealmSecurityManager {

    public AuthenticationInfo authenticate(AuthenticationToken token) throws AuthenticationException {
        return this.authenticator.authenticate(token);
    }

}

繼續向下

5.AbstractAuthenticator

public abstract class AbstractAuthenticator implements Authenticator, LogoutAware {

    public final AuthenticationInfo authenticate(AuthenticationToken token) throws AuthenticationException {
        ...
        info = this.doAuthenticate(token);
        ...
        return info;
        }
    }

}

6.ModularRealmAuthenticator

public class ModularRealmAuthenticator extends AbstractAuthenticator {

    protected AuthenticationInfo doAuthenticate(AuthenticationToken authenticationToken) throws AuthenticationException {
        this.assertRealmsConfigured();
        Collection<Realm> realms = this.getRealms();
        return realms.size() == 1 ? this.doSingleRealmAuthentication((Realm)realms.iterator().next(), authenticationToken) : this.doMultiRealmAuthentication(realms, authenticationToken);
    }

}

還是在ModularRealmAuthenticator中

protected AuthenticationInfo doSingleRealmAuthentication(Realm realm, AuthenticationToken token) {
          ...
            AuthenticationInfo info = realm.getAuthenticationInfo(token);
          ...
       
    }

繼續

7.AuthenticatingRealm

public abstract class AuthenticatingRealm extends CachingRealm implements Initializable {

    public final AuthenticationInfo getAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
        ...
        info = this.doGetAuthenticationInfo(token);
        ...
        return info;
    }

}

然後進入最後一步，在繼承了AuthorizingRealm的自定義的realm中進行處理。

8.自定義realm舉例

    @Override
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken) {
        BackUserToken token = (BackUserToken) authenticationToken;
        List<SysUser> sysUsers = token.getUser();
        if (sysUsers == null || sysUsers.size() == 0) {
            throw new UnknownAccountException();
        }
        if (sysUsers.size() > 1) {
            //用戶重複
            throw new AccountRepeatException();
        }
        if (用戶已過期) {
            if (sysUsers.get(0).getIsAbleDate() == null||sysUsers.get(0).getIsAbleDate().getTime() < new Date().getTime()) {
                //用戶過期(自定義異常)
                throw new DeadlineException();
            }
        }
        SysUser sysUser = sysUsers.get(0);
        SimpleAuthenticationInfo authenticationInfo = new SimpleAuthenticationInfo(
                sysUser,
                sysUser.getPwd(),
                getName() 
        );
        return authenticationInfo;

    }