Shiro笔记（二）身份验证

Shiro笔记（二）身份验证

一、核心代码

 @Test
     public void helloWorldTest(){
         IniSecurityManagerFactory factory =
                 new IniSecurityManagerFactory("classpath:shiro-jdbc-realm.ini");
         SecurityManager manager = factory.getInstance();
        //全局设置，一次即可
         SecurityUtils.setSecurityManager(manager);
         Subject subject = SecurityUtils.getSubject();
         UsernamePasswordToken token =
                 new UsernamePasswordToken("Peter", "123");
         try{
                subject.login(token);
             }catch (AuthenticationException e){
                 e.printStackTrace();
             }

         Assert.assertEquals(true,subject.isAuthenticated());
         //退出登录
         subject.logout();

shiro.ini文件：

[users]
Peter=
Tom=

二、身份认证流程：

Authenticator 可能会委托给相应的 AuthenticationStrategy 进行多 Realm 身份验证，默认
ModularRealmAuthenticator 会调用 AuthenticationStrategy 进行多 Realm 身份验证；
Authenticator 会把相应的 token 传入 Realm，从 Realm 获取身份验证信息

三、Realm

Shiro 从从 Realm 获取安全数据（如用户、角色、权限）

Reaml接口：

 public interface Realm {
     //获得唯一的名字
     String getName();
     //判断此realm是否支持此token
     boolean supports(AuthenticationToken token);
     //获取token认证信息
     AuthenticationInfo getAuthenticationInfo(AuthenticationToken token) throws AuthenticationException;
 }

一）单Realm配置

 public class MyRealm implements Realm{

     public String getName() {
         return "myRealm";
     }

     public boolean supports(AuthenticationToken authenticationToken) {
         //仅支持UsernamePasswordToken类型
         return authenticationToken instanceof UsernamePasswordToken;
     }

     public AuthenticationInfo getAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
         //获取用户名
         String username= (String) token.getPrincipal();
         //获取密码
         String password=new String((char[]) token.getCredentials());
         if(!"Peter".equals(username)){
             throw new UnknownAccountException();
         }
         if(!"123".equals(password)){
             throw new IncorrectCredentialsException();
         }
         return new SimpleAuthenticationInfo(username,password,getName());
     }
 }

ini文件指定：

 myRealm=com.tang.shirotest.LoginLogoutTest
 securityManager.realms=$myRealm

二）JDBC Realm的使用

 [main]
 jdbcRealm=org.apache.shiro.realm.jdbc.JdbcRealm
 dataSource=com.alibaba.druid.pool.DruidDataSource
 dataSource.driverClassName=com.mysql.jdbc.Driver
 dataSource.url=jdbc:mysql://localhost:3306/shiro
 dataSource.username=root
 dataSource.password=jiapi1990
 jdbcRealm.dataSource=$dataSource
 securityManager.realms=$jdbcRealm

三）Authenticator及AuthenticationStrategy

Authenticator的职责是验证用户账号，接口为：

public interface Authenticator {
    AuthenticationInfo authenticate(AuthenticationToken var1) throws AuthenticationException;
}

SecurityManager 接口继承了 Authenticator，另外还有一个 ModularRealmAuthenticator 实现，
其委托给多个 Realm 进行验证，验证规则通过 AuthenticationStrategy 接口指定，默认提供
的实现：
FirstSuccessfulStrategy：只要有一个 Realm 验证成功即可，只返回第一个 Realm 身份验证
成功的认证信息，其他的忽略；
AtLeastOneSuccessfulStrategy：只要有一个 Realm 验证成功即可，和 FirstSuccessfulStrategy
不同，返回所有 Realm 身份验证成功的认证信息；
AllSuccessfulStrategy：所有 Realm 验证成功才算成功，且返回所有 Realm 身份验证成功的
认证信息，如果有一个失败就失败了

ModularRealmAuthenticator 默认使用 AtLeastOneSuccessfulStrategy 策略。

ini文件：

 #指定 securityManager 的 authenticator 实现
 authenticator=org.apache.shiro.authc.pam.ModularRealmAuthenticator
 securityManager.authenticator=$authenticator
 #指定 securityManager.authenticator 的 authenticationStrategy
 allSuccessfulStrategy=org.apache.shiro.authc.pam.AllSuccessfulStrategy
 securityManager.authenticator.authenticationStrategy=$allSuccessfulStrategy
 myRealm1=com.github.zhangkaitao.shiro.chapter2.realm.MyRealm1
 myRealm2=com.github.zhangkaitao.shiro.chapter2.realm.MyRealm2
 myRealm3=com.github.zhangkaitao.shiro.chapter2.realm.MyRealm3
 securityManager.realms=$myRealm1,$myRealm3

AuthenticationStrategy接口：

 public interface AuthenticationStrategy {
     //在所有 Realm 验证之前调用
     AuthenticationInfo beforeAllAttempts(Collection<? extends Realm> realms, AuthenticationToken token) throws AuthenticationException;
     //在每个 Realm 之前调用
     AuthenticationInfo beforeAttempt(Realm realm, AuthenticationToken token, AuthenticationInfo aggregate) throws AuthenticationException;
     //在每个 Realm 之后调用
     AuthenticationInfo afterAttempt(Realm realm, AuthenticationToken token, AuthenticationInfo singleRealmInfo, AuthenticationInfo aggregateInfo, Throwable t)
             throws AuthenticationException;
     ////在所有 Realm 之后调用
     AuthenticationInfo afterAllAttempts(AuthenticationToken token, AuthenticationInfo aggregate) throws AuthenticationException;
 }

自定义实现：

 public class AtLeastTwoAuthenticatorStrategy extends AbstractAuthenticationStrategy {

     @Override
     public AuthenticationInfo beforeAllAttempts(Collection<? extends Realm> realms, AuthenticationToken token) throws AuthenticationException {
         return new SimpleAuthenticationInfo();//返回一个权限的认证信息
     }

     @Override
     public AuthenticationInfo beforeAttempt(Realm realm, AuthenticationToken token, AuthenticationInfo aggregate) throws AuthenticationException {
         return aggregate;//返回之前合并的
     }

     @Override
     public AuthenticationInfo afterAttempt(Realm realm, AuthenticationToken token, AuthenticationInfo singleRealmInfo, AuthenticationInfo aggregateInfo, Throwable t) throws AuthenticationException {
         AuthenticationInfo info;
         if (singleRealmInfo == null) {
             info = aggregateInfo;
         } else {
             if (aggregateInfo == null) {
                 info = singleRealmInfo;
             } else {
                 info = merge(singleRealmInfo, aggregateInfo);
             }
         }

         return info;
     }

     @Override
     public AuthenticationInfo afterAllAttempts(AuthenticationToken token, AuthenticationInfo aggregate) throws AuthenticationException {
         if (aggregate == null || CollectionUtils.isEmpty(aggregate.getPrincipals()) || aggregate.getPrincipals().getRealmNames().size() < 2) {
             throw new AuthenticationException("Authentication token of type [" + token.getClass() + "] " +
                     "could not be authenticated by any configured realms.  Please ensure that at least two realm can " +
                     "authenticate these tokens.");
         }

         return aggregate;
     }
 }