Shiro认证过程

疯狂的KK

发布于 2020-02-19 11:23:03

5990

发布于 2020-02-19 11:23:03

文章被收录于专栏：Java项目实战

Shiro的架构了解之后，走一下debug，跟一下认证的流程。使用Realm来认证用户名密码。

使用realm访问数据库里的数据

获取当前的subject

校验subject是否已经登录

若没有认证则封装用户名密码

1.0创建表单页面存储提交

2.0请求提交到mvc的handler

3.0获取用户名密码

4.0执行登录：调用subject的login(token)

5.0自定义realm，从数据库获取对应记录，返回给shiro

Realm实现类AuthenticatingRealm

protected abstract AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken var1) throws AuthenticationException;

实现该方法

6.0Shiro完成对密码的比对

currentUser.login(token);login方法的实现
void login(AuthenticationToken var1) throws AuthenticationException;

向下走，看下实现

public void login(AuthenticationToken token) throws AuthenticationException {
    this.clearRunAsIdentitiesInternal();
    Subject subject = this.securityManager.login(this, token);
    String host = null;
    PrincipalCollection principals;
    if (subject instanceof DelegatingSubject) {
        DelegatingSubject delegating = (DelegatingSubject)subject;
        principals = delegating.principals;
        host = delegating.host;
    } else {
        principals = subject.getPrincipals();
    }

    if (principals != null && !principals.isEmpty()) {
        this.principals = principals;
        this.authenticated = true;
        if (token instanceof HostAuthenticationToken) {
            host = ((HostAuthenticationToken)token).getHost();
        }

        if (host != null) {
            this.host = host;
        }

        Session session = subject.getSession(false);
        if (session != null) {
            this.session = this.decorate(session);
        } else {
            this.session = null;
        }

    } else {
        String msg = "Principals returned from securityManager.login( token ) returned a null or empty value.  This value must be non null and populated with one or more elements.";
        throw new IllegalStateException(msg);
    }
}

info = this.authenticate(token);

public AuthenticationInfo authenticate(AuthenticationToken token) throws AuthenticationException {
    return this.authenticator.authenticate(token);
}

最终调用的

==============
public final AuthenticationInfo getAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
    AuthenticationInfo info = this.getCachedAuthenticationInfo(token);
    if (info == null) {
        info = this.doGetAuthenticationInfo(token);
        log.debug("Looked up AuthenticationInfo [{}] from doGetAuthenticationInfo", info);
        if (token != null && info != null) {
            this.cacheAuthenticationInfoIfPossible(token, info);
        }
    } else {
        log.debug("Using cached authentication info [{}] to perform credentials matching.", info);
    }

    if (info != null) {
        this.assertCredentialsMatch(token, info);
    } else {
        log.debug("No AuthenticationInfo found for submitted AuthenticationToken [{}].  Returning null.", token);
    }

    return info;
}

int i = token.hashCode();
此时的hashcode与 info = this.doGetAuthenticationInfo(token);
doGetAuthenticationInfo获取的token是一致的

但是会由于缓存不能达到登录后在返回同样验证的效果

Shiro如何比对密码

token中保存了从数据库获取的密码以及从前台传过来的密码

然后进行比对

密码的比对

public boolean doCredentialsMatch(AuthenticationToken token, AuthenticationInfo info) {
    Object tokenCredentials = getCredentials(token);
    Object accountCredentials = getCredentials(info);
    return equals(tokenCredentials, accountCredentials);
}
public void setCredentialsMatcher(CredentialsMatcher credentialsMatcher) {
    this.credentialsMatcher = credentialsMatcher;
}