shiro拦截认证的全过程记录

概述

shiro是apache旗下一个开源安全框架(http://shiro.apache.org/)，它将软件系统的安全认证相关的功能抽取出来，实现用户身份认证，权限授权、加密、会话管理等功能，组成了一个通用的安全认证框架。使用shiro就可以非常快速的完成认证、授权等功能的开发，降低系统成本。

shiro框架三大核心对象

说明：

1)subject :主体对象，负责提交用户认证和授权信息。

2)securitymanager：安全管理器，负责认证，授权等业务实现。（核心）

3)realm：领域对象，负责从数据层获取业务数据。

shrio 拦截认证全过程

 1.filterregistrationbean过滤注册bean

@bean
public filterregistrationbean shirofilterregistration() {
    filterregistrationbean registration = new filterregistrationbean();
    registration.setfilter(new delegatingfilterproxy("shirofilter"));
    //该值缺省为false，表示生命周期由springapplicationcontext管理，设置为true则表示由servletcontainer管理
    registration.addinitparameter("targetfilterlifecycle", "true");
    registration.setenabled(true);
    registration.setorder(integer.max_value - 1);
    registration.addurlpatterns("/*");
    return registration;
}

设置过滤的bean

2.shirofilter 实际过滤配置bean

@bean("shirofilter")
public shirofilterfactorybean shirfilter(securitymanager securitymanager) {
    shirofilterfactorybean shirofilter = new shirofilterfactorybean();
    shirofilter.setsecuritymanager(securitymanager);

    //oauth过滤
    map<string, filter> filters = new hashmap<>(10);
    filters.put("oauth2", new oauth2filter());
    shirofilter.setfilters(filters);

    map<string, string> filtermap = new linkedhashmap<>();
    filtermap.put("/webjars/**", "anon");
    filtermap.put("/druid/**", "anon");
    filtermap.put("/login", "anon");

    filtermap.put("/**", "oauth2");
    shirofilter.setfilterchaindefinitionmap(filtermap);

    return shirofilter;
}

配置oauth2filter为过滤类 过滤对象处/webjars/** /druid/** /login 外的所有

3.过滤类oauth2filter 继承 authenticationfilter 重写以下方法

/**
 * 验证是否有效token
 * @param request re
 * @param response res
 * @return 验证token
 * @throws exception
 */
@override
protected boolean onaccessdenied(servletrequest request, servletresponse response) throws exception {
    //获取请求token，如果token不存在，直接返回401
    string token = getrequesttoken((httpservletrequest) request);
    if(stringutils.isblank(token)){
        httpservletresponse httpresponse = (httpservletresponse) response;
        httpresponse.setcontenttype("application/json;charset=utf-8");
        httpresponse.setheader("access-control-allow-credentials", "true");
        httpresponse.setheader("access-control-allow-origin", httpcontextutils.getorigin());

        string json = new gson().tojson(new result().error(errorcode.unauthorized));

        httpresponse.getwriter().print(json);

        return false;
    }

    return executelogin(request, response);
}

4.调用父类 executelogin 进行登录验证

protected boolean executelogin(servletrequest request, servletresponse response) throws exception {
    authenticationtoken token = this.createtoken(request, response);
    if (token == null) {
        string msg = "createtoken method implementation returned null. a valid non-null authenticationtoken must be created in order to execute a login attempt.";
        throw new illegalstateexception(msg);
    } else {
        try {
            subject subject = this.getsubject(request, response);
            subject.login(token);
            return this.onloginsuccess(token, subject, request, response);
        } catch (authenticationexception var5) {
            return this.onloginfailure(token, var5, request, response);
        }
    }
}

5.subject.login(token); 进行登录

login方法被delegatingsubject重写

public void login(authenticationtoken token) throws authenticationexception {
    **
    subject subject = this.securitymanager.login(this, token);
    **
}

6.securitymanager.login(this, token) login被defaultsecuritymanager

接下来几步没那么重要省略部分

7.modularrealmauthenticator authenticationinfo 授权信息获取方法

protected authenticationinfo doauthenticate(authenticationtoken authenticationtoken) throws authenticationexception {
    this.assertrealmsconfigured();
    collection<realm> realms = this.getrealms();
    return realms.size() == 1 ? this.dosinglerealmauthentication((realm)realms.iterator().next(), authenticationtoken) : this.domultirealmauthentication(realms, authenticationtoken);
}

getrealms 获取我们自己重写的realms类，主要用户获取用户信息

8.接下来则进入我们自己写的realms类 我的类叫oauth2realm

/**
 * 认证(登录时调用)
 */
@override
protected authenticationinfo dogetauthenticationinfo(authenticationtoken token) throws authenticationexception {
    string accesstoken = (string) token.getprincipal();

    //根据accesstoken，查询用户信息
    sysusertokenentity tokenentity = shiroservice.getbytoken(accesstoken);
    //token失效
    if(tokenentity == null || tokenentity.getexpiredate().gettime() < system.currenttimemillis()){
        throw new incorrectcredentialsexception(messageutils.getmessage(errorcode.token_invalid));
    }

    //查询用户信息
    sysuserentity userentity = shiroservice.getuser(tokenentity.getuserid());

    //转换成userdetail对象
    userdetail userdetail = convertutils.sourcetotarget(userentity, userdetail.class);

    //获取用户对应的部门数据权限
    list<long> deptidlist = shiroservice.getdatascopelist(userdetail.getid());
    userdetail.setdeptidlist(deptidlist);

    //账号锁定
    if(userdetail.getstatus() == 0){
        throw new lockedaccountexception(messageutils.getmessage(errorcode.account_lock));
    }

    simpleauthenticationinfo info = new simpleauthenticationinfo(userdetail, accesstoken, getname());
    return info;
}

负责获取用户信息的方法

这并不是登录的过程，而是授权过滤的过程，通过token到数据库查询是否有这个用户，且没有过期，则证明已经登录。

总结

到此这篇关于shrio拦截认证的文章就介绍到这了,更多相关shrio拦截认证内容请搜索以前的文章或继续浏览下面的相关文章希望大家以后多多支持！