欧美激情一区二区久久久久久,亚洲小说图片乱伦,久久久久久久99精品免费观看

源碼分析shiro認證授權流程（shiro框架的認證和授權流程）

1. shiro介紹

Apache Shiro是一個強大易用的Java安全框架，提供了認證、授權、加密和會話管理等功能：

認證 – 用戶身份識別，常被稱為用戶“登錄”；
授權 – 訪問控制；
密碼加密 – 保護或隱藏數據防止被偷窺；
會話管理 – 每用戶相關的時間敏感的狀態。

對于任何一個應用程序，Shiro都可以提供全面的安全管理服務。并且相對于其他安全框架，Shiro要簡單的多。

2. shiro源碼概況

先要了解shiro的基本框架(見http://www.cnblogs.com/davidwang456/p/4425145.html)。

然后看一下各個組件之間的關系：

源碼分析shiro認證授權流程（shiro框架的認證和授權流程）

一下內容參考：http://kdboy.iteye.com/blog/1154644

subject：即“當前操作用戶”。但是，在Shiro中，Subject這一概念并不僅僅指人，也可以是第三方進程、后臺帳戶（Daemon Account）或其他類似事物。它僅僅意味著“當前跟軟件交互的東西”。但考慮到大多數目的和用途，你可以把它認為是Shiro的“用戶”概念。

Subject代表了當前用戶的安全操作，SecurityManager則管理所有用戶的安全操作。

SecurityManager：它是Shiro框架的核心，典型的Facade模式，Shiro通過SecurityManager來管理內部組件實例，并通過它來提供安全管理的各種服務。

Realm： Realm充當了Shiro與應用安全數據間的“橋梁”或者“連接器”。也就是說，當對用戶執行認證（登錄）和授權（訪問控制）驗證時，Shiro會從應用配置的Realm中查找用戶及其權限信息。

從這個意義上講，Realm實質上是一個安全相關的DAO：它封裝了數據源的連接細節，并在需要時將相關數據提供給Shiro。當配置Shiro時，你必須至少指定一個Realm，用于認證和（或）授權。配置多個Realm是可以的，但是至少需要一個。

Shiro內置了可以連接大量安全數據源（又名目錄）的Realm，如LDAP、關系數據庫（JDBC）、類似INI的文本配置資源以及屬性文件等。如果缺省的Realm不能滿足需求，你還可以插入代表自定義數據源的自己的Realm實現。

Shiro主要組件還包括：

Authenticator ：認證就是核實用戶身份的過程。這個過程的常見例子是大家都熟悉的“用戶/密碼”組合。多數用戶在登錄軟件系統時，通常提供自己的用戶名（當事人）和支持他們的密碼（證書）。如果存儲在系統中的密碼（或密碼表示）與用戶提供的匹配，他們就被認為通過認證。

Authorizer ：授權實質上就是訪問控制 – 控制用戶能夠訪問應用中的哪些內容，比如資源、Web頁面等等。

sessionManager ：在安全框架領域，Apache Shiro提供了一些獨特的東西：可在任何應用或架構層一致地使用Session API。即，Shiro為任何應用提供了一個會話編程范式 – 從小型后臺獨立應用到大型集群Web應用。這意味著，那些希望使用會話的應用開發者，不必被迫使用Servlet或EJB容器了。或者，如果正在使用這些容器，開發者現在也可以選擇使用在任何層統一一致的會話API，取代Servlet或EJB機制。

CacheManager :對Shiro的其他組件提供緩存支持。

3. 做一個demo，跑shiro的源碼，從login開始：

第一步：用戶根據表單信息填寫用戶名和密碼，然后調用登陸按鈕。內部執行如下：

usernamePasswordToken token = new UsernamePasswordToken(loginForm.getUsername(), loginForm.getPassphrase()); token.setRememberMe(true); Subject currentUser = SecurityUtils.getSubject(); currentUser.login(token);

第二步：代理DelegatingSubject繼承Subject執行login

public void login(AuthenticationToken token) throws AuthenticationException { clearRunAsIdentitiesInternal(); Subject subject = securityManager.login(this, token); PrincipalCollection principals; String host = null; if (subject instanceof DelegatingSubject) { DelegatingSubject delegating = (DelegatingSubject) subject; //we have to do this in case there are assumed identities – we don\’t want to lose the \’real\’ principals: principals = delegating.principals; host = delegating.host; } else { principals = subject.getPrincipals(); } if (principals == null || principals.isEmpty()) { String msg = \”Principals returned from securityManager.login( token ) returned a null or \” \”empty value. This value must be non null and populated with one or more elements.\”; throw new IllegalStateException(msg); } this.principals = principals; this.authenticated = true; if (token instanceof HostAuthenticationToken) { host = ((HostAuthenticationToken) token).getHost(); } if (host != null) { this.host = host; } Session session = subject.getSession(false); if (session != null) { this.session = decorate(session); } else { this.session = null; } }

第三步：調用DefaultSecurityManager繼承SessionsSecurityManager執行login方法

public Subject login(Subject subject, AuthenticationToken token) throws AuthenticationException { AuthenticationInfo info; try { info = authenticate(token); } catch (AuthenticationException ae) { try { onFailedLogin(token, ae, subject); } catch (Exception e) { if (log.isInfoEnabled()) { log.info(\”onFailedLogin method threw an \” \”exception. Logging and propagating original AuthenticationException.\”, e); } } throw ae; //propagate } Subject loggedIn = createSubject(token, info, subject); onSuccessfulLogin(token, info, loggedIn); return loggedIn; }

第四步：認證管理器AuthenticatingSecurityManager繼承RealmSecurityManager執行authenticate方法：

/** * Delegates to the wrapped {@link org.apache.shiro.authc.Authenticator Authenticator} for authentication. */ public AuthenticationInfo authenticate(AuthenticationToken token) throws AuthenticationException { return this.authenticator.authenticate(token); }

第五步：抽象認證管理器AbstractAuthenticator繼承Authenticator, LogoutAware 執行authenticate方法：

public final AuthenticationInfo authenticate(AuthenticationToken token) throws AuthenticationException { if (token == null) { throw new IllegalArgumentException(\”Method argumet (authentication token) cannot be null.\”); } log.trace(\”Authentication attempt received for token [{}]\”, token); AuthenticationInfo info; try { info = doAuthenticate(token); if (info == null) { String msg = \”No account information found for authentication token [\” token \”] by this \” \”Authenticator instance. Please check that it is configured correctly.\”; throw new AuthenticationException(msg); } } catch (Throwable t) { AuthenticationException ae = null; if (t instanceof AuthenticationException) { ae = (AuthenticationException) t; } if (ae == null) { //Exception thrown was not an expected AuthenticationException. Therefore it is probably a little more //severe or unexpected. So, wrap in an AuthenticationException, log to warn, and propagate: String msg = \”Authentication failed for token submission [\” token \”]. Possible unexpected \” \”error? (Typical or expected login exceptions should extend from AuthenticationException).\”; ae = new AuthenticationException(msg, t); } try { notifyFailure(token, ae); } catch (Throwable t2) { if (log.isWarnEnabled()) { String msg = \”Unable to send notification for failed authentication attempt – listener error?. \” \”Please check your AuthenticationListener implementation(s). Logging sending exception \” \”and propagating original AuthenticationException instead…\”; log.warn(msg, t2); } } throw ae; } log.debug(\”Authentication successful for token [{}]. Returned account [{}]\”, token, info); notifySuccess(token, info); return info; }

第六步：ModularRealmAuthenticator繼承AbstractAuthenticator執行doAuthenticate方法

protected AuthenticationInfo doAuthenticate(AuthenticationToken authenticationToken) throws AuthenticationException { assertRealmsConfigured(); Collection<Realm> realms = getRealms(); if (realms.size() == 1) { return doSingleRealmAuthentication(realms.iterator().next(), authenticationToken); } else { return doMultiRealmAuthentication(realms, authenticationToken); } }

接著調用：

/** * Performs the authentication attempt by interacting with the single configured realm, which is significantly * simpler than performing multi-realm logic. * * @param realm the realm to consult for AuthenticationInfo. * @param token the submitted AuthenticationToken representing the subject\’s (user\’s) log-in principals and credentials. * @return the AuthenticationInfo associated with the user account corresponding to the specified {@code token} */ protected AuthenticationInfo doSingleRealmAuthentication(Realm realm, AuthenticationToken token) { if (!realm.supports(token)) { String msg = \”Realm [\” realm \”] does not support authentication token [\” token \”]. Please ensure that the appropriate Realm implementation is \” \”configured correctly or that the realm accepts AuthenticationTokens of this type.\”; throw new UnsupportedTokenException(msg); } AuthenticationInfo info = realm.getAuthenticationInfo(token); if (info == null) { String msg = \”Realm [\” realm \”] was unable to find account data for the \” \”submitted AuthenticationToken [\” token \”].\”; throw new UnknownAccountException(msg); } return info; }

第七步：AuthenticatingRealm繼承CachingRealm執行getAuthenticationInfo方法

public final AuthenticationInfo getAuthenticationInfo(AuthenticationToken token) throws AuthenticationException { AuthenticationInfo info = getCachedAuthenticationInfo(token); //從緩存中讀取 if (info == null) { //otherwise not cached, perform the lookup: info = doGetAuthenticationInfo(token); //緩存中讀不到，則到數據庫或者ldap或者jndi等去讀 log.debug(\”Looked up AuthenticationInfo [{}] from doGetAuthenticationInfo\”, info); if (token != null && info != null) { cacheAuthenticationInfoIfPossible(token, info); } } else { log.debug(\”Using cached authentication info [{}] to perform credentials matching.\”, info); } if (info != null) { assertCredentialsMatch(token, info); } else { log.debug(\”No AuthenticationInfo found for submitted AuthenticationToken [{}]. Returning null.\”, token); } return info; }

1. 從緩存中讀取的方法：

/** * Checks to see if the authenticationCache class attribute is null, and if so, attempts to acquire one from * any configured {@link #getCacheManager() cacheManager}. If one is acquired, it is set as the class attribute. * The class attribute is then returned. * * @return an available cache instance to be used for authentication caching or {@code null} if one is not available. * @since 1.2 */ private Cache<Object, AuthenticationInfo> getAuthenticationCacheLazy() { if (this.authenticationCache == null) { log.trace(\”No authenticationCache instance set. Checking for a cacheManager…\”); CacheManager cacheManager = getCacheManager(); if (cacheManager != null) { String cacheName = getAuthenticationCacheName(); log.debug(\”CacheManager [{}] configured. Building authentication cache \'{}\’\”, cacheManager, cacheName); this.authenticationCache = cacheManager.getCache(cacheName); } } return this.authenticationCache; }

2. 從數據庫中讀取的方法：

JdbcRealm繼承 AuthorizingRealm執行doGetAuthenticationInfo方法

protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException { UsernamePasswordToken upToken = (UsernamePasswordToken) token; String username = upToken.getUsername(); // Null username is invalid if (username == null) { throw new AccountException(\”Null usernames are not allowed by this realm.\”); } Connection conn = null; SimpleAuthenticationInfo info = null; try { conn = dataSource.getConnection(); String password = null; String salt = null; switch (saltStyle) { case NO_SALT: password = getPasswordForUser(conn, username)[0]; break; case CRYPT: // TODO: separate password and hash from getPasswordForUser[0] throw new ConfigurationException(\”Not implemented yet\”); //break; case COLUMN: String[] queryResults = getPasswordForUser(conn, username); password = queryResults[0]; salt = queryResults[1]; break; case EXTERNAL: password = getPasswordForUser(conn, username)[0]; salt = getSaltForUser(username); } if (password == null) { throw new UnknownAccountException(\”No account found for user [\” username \”]\”); } info = new SimpleAuthenticationInfo(username, password.toCharArray(), getName()); if (salt != null) { info.setCredentialsSalt(ByteSource.Util.bytes(salt)); } } catch (SQLException e) { final String message = \”There was a SQL error while authenticating user [\” username \”]\”; if (log.isErrorEnabled()) { log.error(message, e); } // Rethrow any SQL errors as an authentication exception throw new AuthenticationException(message, e); } finally { JdbcUtils.closeConnection(conn); } return info; }

接著調用sql語句：

private String[] getPasswordForUser(Connection conn, String username) throws SQLException { String[] result; boolean returningSeparatedSalt = false; switch (saltStyle) { case NO_SALT: case CRYPT: case EXTERNAL: result = new String[1]; break; default: result = new String[2]; returningSeparatedSalt = true; } PreparedStatement ps = null; ResultSet rs = null; try { ps = conn.prepareStatement(authenticationQuery); ps.setString(1, username); // Execute query rs = ps.executeQuery(); // Loop over results – although we are only expecting one result, since usernames should be unique boolean foundResult = false; while (rs.next()) { // Check to ensure only one row is processed if (foundResult) { throw new AuthenticationException(\”More than one user row found for user [\” username \”]. Usernames must be unique.\”); } result[0] = rs.getString(1); if (returningSeparatedSalt) { result[1] = rs.getString(2); } foundResult = true; } } finally { JdbcUtils.closeResultSet(rs); JdbcUtils.closeStatement(ps); } return result; }

其中authenticationQuery定義如下：

protected String authenticationQuery = DEFAULT_AUTHENTICATION_QUERY; protected static final String DEFAULT_AUTHENTICATION_QUERY = \”select password from users where username = ?\”;

4. 小結

Apache Shiro 是功能強大并且容易集成的開源權限框架，它能夠完成認證、授權、加密、會話管理等功能。認證和授權為權限控制的核心，簡單來說，“認證”就是證明你是誰？ Web 應用程序一般做法通過表單提交用戶名及密碼達到認證目的。“授權”即是否允許已認證用戶訪問受保護資源。

參考文獻：

http://kdboy.iteye.com/blog/1154644

http://www.ibm.com/developerworks/cn/java/j-lo-shiro/