Apache Shiro的登录过程分析

缺乏、安全感 2022-05-20 03:22 50阅读 0赞

来源：https://blog.csdn.net/jin5203344/article/details/53174341

关于shiro就不用做过多介绍了，今天主要分析下登录过程

首先我大致画了个流程图（可能不够详细）：

![Center][]

第一步：用户登录，根据用户登录名密码生产Token

1.  UsernamePasswordToken token = new UsernamePasswordToken(username, password);
2.  Subject subject = SecurityUtils.getSubject();
3.  subject.login(token);

这里调用了代理subject的login方法，代码如下：

1.  public void login(AuthenticationToken token) throws AuthenticationException \{
2.  clearRunAsIdentitiesInternal();
3.  Subject subject = securityManager.login( this, token);
4.  
5.  PrincipalCollection principals;
6.  
7.  String host = null;
8.  
9.  if (subject instanceof DelegatingSubject) \{
10. DelegatingSubject delegating = (DelegatingSubject) subject;
11. //we have to do this in case there are assumed identities - we don't want to lose the 'real' principals:
12. principals = delegating.principals;
13. host = delegating.host;
14. \} else \{
15. principals = subject.getPrincipals();
16. \}
17. 
18. if (principals == null || principals.isEmpty()) \{
19. String msg = "Principals returned from securityManager.login( token ) returned a null or " \+
20. "empty value. This value must be non null and populated with one or more elements.";
21. throw new IllegalStateException(msg);
22. \}
23. this.principals = principals;
24. this.authenticated = true;
25. if (token instanceof HostAuthenticationToken) \{
26. host = ((HostAuthenticationToken) token).getHost();
27. \}
28. if (host != null) \{
29. this.host = host;
30. \}
31. Session session = subject.getSession( false);
32. if (session != null) \{
33. this.session = decorate(session);
34. \} else \{
35. this.session = null;
36. \}
37. \}

可以看到第二行，实际是调用securityManager的login方法

第二步：调用securityManager的login方法

1.  public Subject login(Subject subject, AuthenticationToken token) throws AuthenticationException \{
2.  AuthenticationInfo info;
3.  try \{
4.  info = authenticate(token);
5.  \} catch (AuthenticationException ae) \{
6.  try \{
7.  onFailedLogin(token, ae, subject);
8.  \} catch (Exception e) \{
9.  if (log.isInfoEnabled()) \{
10. log.info( "onFailedLogin method threw an " \+
11. "exception. Logging and propagating original AuthenticationException.", e);
12. \}
13. \}
14. throw ae; //propagate
15. \}
16. 
17. Subject loggedIn = createSubject(token, info, subject);
18. 
19. onSuccessfulLogin(token, info, loggedIn);
20. 
21. return loggedIn;
22. \}

第三步：调用securityManager的 authenticate方法 该方法在 其上级类 AuthenticatingSecurityManager中，代码如下：

1.  public AuthenticationInfo authenticate(AuthenticationToken token) throws AuthenticationException \{
2.  return this.authenticator.authenticate(token);
3.  \}

实际调用了authenticator的authenticate方法，而AuthenticatingSecurityManager的无参构造函数中

1.  public AuthenticatingSecurityManager()\{
2.  super();
3.  this.authenticator = new ModularRealmAuthenticator();
4.  \}

而ModularRealmAuthenticator类继承了AbstractAuthenticator类

第四步：调用AbstractAuthenticator的authenticate方法

1.  public final AuthenticationInfo authenticate(AuthenticationToken token) throws AuthenticationException \{
2.  
3.  if (token == null) \{
4.  throw new IllegalArgumentException( "Method argumet (authentication token) cannot be null.");
5.  \}
6.  
7.  log.trace( "Authentication attempt received for token \[\{\}\]", token);
8.  
9.  AuthenticationInfo info;
10. try \{
11. info = doAuthenticate(token);
12. if (info == null) \{
13. String msg = "No account information found for authentication token \[" \+ token + "\] by this " \+
14. "Authenticator instance. Please check that it is configured correctly.";
15. throw new AuthenticationException(msg);
16. \}
17. \} catch (Throwable t) \{
18. AuthenticationException ae = null;
19. if (t instanceof AuthenticationException) \{
20. ae = (AuthenticationException) t;
21. \}
22. if (ae == null) \{
23. //Exception thrown was not an expected AuthenticationException. Therefore it is probably a little more
24. //severe or unexpected. So, wrap in an AuthenticationException, log to warn, and propagate:
25. String msg = "Authentication failed for token submission \[" \+ token + "\]. Possible unexpected " \+
26. "error? (Typical or expected login exceptions should extend from AuthenticationException).";
27. ae = new AuthenticationException(msg, t);
28. \}
29. try \{
30. notifyFailure(token, ae);
31. \} catch (Throwable t2) \{
32. if (log.isWarnEnabled()) \{
33. String msg = "Unable to send notification for failed authentication attempt - listener error?. " \+
34. "Please check your AuthenticationListener implementation(s). Logging sending exception " \+
35. "and propagating original AuthenticationException instead...";
36. log.warn(msg, t2);
37. \}
38. \}
39. 
40. 
41. throw ae;
42. \}
43. 
44. log.debug( "Authentication successful for token \[\{\}\]. Returned account \[\{\}\]", token, info);
45. 
46. notifySuccess(token, info);
47. 
48. return info;
49. \}

看try语句中的 doAuthenticate（）方法 则是在其子类ModularRealmAuthenticator中实现，所以

第五步：调用ModularRealmAuthenticator的doAuthenticate方法

1.  protected AuthenticationInfo doAuthenticate(AuthenticationToken authenticationToken) throws AuthenticationException \{
2.  assertRealmsConfigured();
3.  Collection<Realm> realms = getRealms();
4.  if (realms.size() == 1) \{
5.  return doSingleRealmAuthentication(realms.iterator().next(), authenticationToken);
6.  \} else \{
7.  return doMultiRealmAuthentication(realms, authenticationToken);
8.  \}
9.  \}

第二行获取realms，但我们记得只配置过realm,realms是什么时候赋值的呢，其实很简单  spring对bean属性的赋值是通过反射 实际调用的是set方法，即我们配置了

一个property 为realm的属性  对属性注入的时候调用的setRealm方法

1.  public void setRealm(Realm realm)\{
2.  if (realm == null) \{
3.  throw new IllegalArgumentException( "Realm argument cannot be null");
4.  \}
5.  Collection<Realm> realms = new ArrayList<Realm>( 1);
6.  realms.add(realm);
7.  setRealms(realms);
8.  \}

所以这里我们的realms实际就是配置的realm，当然前提是我们只配置了单个

第六步：调用ModularRealmAuthenticator的doSingleRealmAuthentication方法

1.  protected AuthenticationInfo doSingleRealmAuthentication(Realm realm, AuthenticationToken token)\{
2.  if (!realm.supports(token)) \{
3.  String msg = "Realm \[" \+ realm + "\] does not support authentication token \[" \+
4.  token + "\]. Please ensure that the appropriate Realm implementation is " \+
5.  "configured correctly or that the realm accepts AuthenticationTokens of this type.";
6.  throw new UnsupportedTokenException(msg);
7.  \}
8.  AuthenticationInfo info = realm.getAuthenticationInfo(token);
9.  if (info == null) \{
10. String msg = "Realm \[" \+ realm + "\] was unable to find account data for the " \+
11. "submitted AuthenticationToken \[" \+ token + "\].";
12. throw new UnknownAccountException(msg);
13. \}
14. return info;
15. \}

其中调用了realm自身的getAuthenticationInfo方法

第七步：调用AuthenticatingRealm的getAuthenticationInfo方法

1.  public final AuthenticationInfo getAuthenticationInfo(AuthenticationToken token) throws AuthenticationException \{
2.  
3.  AuthenticationInfo info = getCachedAuthenticationInfo(token);
4.  if (info == null) \{
5.  //otherwise not cached, perform the lookup:
6.  info = doGetAuthenticationInfo(token);
7.  log.debug( "Looked up AuthenticationInfo \[\{\}\] from doGetAuthenticationInfo", info);
8.  if (token != null && info != null) \{
9.  cacheAuthenticationInfoIfPossible(token, info);
10. \}
11. \} else \{
12. log.debug( "Using cached authentication info \[\{\}\] to perform credentials matching.", info);
13. \}
14. 
15. if (info != null) \{
16. assertCredentialsMatch(token, info);
17. \} else \{
18. log.debug( "No AuthenticationInfo found for submitted AuthenticationToken \[\{\}\]. Returning null.", token);
19. \}
20. 
21. return info;
22. \}

第一行代码，通过缓存获取AuthenticationInfo，说到这里正好看看缓存是怎么实现的，同样代码全在这，跟着走就行

而我们的cacheManager哪来的呢，我们发现在setRealm方法中调用了setRealms

1.  public void setRealms(Collection<Realm> realms)\{
2.  if (realms == null) \{
3.  throw new IllegalArgumentException( "Realms collection argument cannot be null.");
4.  \}
5.  if (realms.isEmpty()) \{
6.  throw new IllegalArgumentException( "Realms collection argument cannot be empty.");
7.  \}
8.  this.realms = realms;
9.  afterRealmsSet();
10. \}
11. 
12. protected void afterRealmsSet()\{
13. applyCacheManagerToRealms();
14. applyEventBusToRealms();
15. \}

可以看到在设置完realms以后调用了一个后续处理方法，在afterRealmsSet中 有个调用 applyCacheManagerToRealms方法 ，字面意思也是很好理解 应用缓存管理器

到realms中，而这种方法代码为：

1.  protected void applyCacheManagerToRealms()\{
2.  CacheManager cacheManager = getCacheManager();
3.  Collection<Realm> realms = getRealms();
4.  if (cacheManager != null && realms != null && !realms.isEmpty()) \{
5.  for (Realm realm : realms) \{
6.  if (realm instanceof CacheManagerAware) \{
7.  ((CacheManagerAware) realm).setCacheManager(cacheManager);
8.  \}
9.  \}
10. \}
11. \}

实际就是判断如果cacheManager不为空 就循环realms设置cacheManager

（有点啰嗦，哈哈，自己当时就是这么想的）

在上面getAuthenticationInfo方法中，我们刚才说过第一行是从缓存中取AuthenticationInfo，如果为空

第八步：调用realm的doGetAuthenticationInfo方法

1.  protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException \{
2.  // TODO Auto-generated method stub
3.  String userName = (String) token.getPrincipal();
4.  //通过token获取用户信息,这里我们一般从数据库中查询
5.  SimpleAuthenticationInfo authenticationInfo = new SimpleAuthenticationInfo(user, password, getName());
6.  return authenticationInfo;
7.  \}

返回AuthenticationInfo，接着下面代码

1.  if (token != null && info != null) \{
2.  cacheAuthenticationInfoIfPossible(token, info);
3.  \}

判断 如果token与获取到的 AuthenticationInfo都不为空，缓存 AuthenticationInfo信息

关于从缓存中查询AuthenticationInfo以及缓存AuthenticationInfo信息的方法 这里就不作分析了，可以看做对一个map的操作吧

当然到这里还没完，同样在上面方法中，

1.  if (info != null) \{
2.  assertCredentialsMatch(token, info);
3.  \} else \{
4.  log.debug( "No AuthenticationInfo found for submitted AuthenticationToken \[\{\}\]. Returning null.", token);
5.  \}

如果 AuthenticationInfo不为空 即通过登录用户查询到了对应的信息

第九步：调用assertCredentialsMatch方法

1.  protected void assertCredentialsMatch(AuthenticationToken token, AuthenticationInfo info) throws AuthenticationException \{
2.  CredentialsMatcher cm = getCredentialsMatcher();
3.  if (cm != null) \{
4.  if (!cm.doCredentialsMatch(token, info)) \{
5.  //not successful - throw an exception to indicate this:
6.  String msg = "Submitted credentials for token \[" \+ token + "\] did not match the expected credentials.";
7.  throw new IncorrectCredentialsException(msg);
8.  \}
9.  \} else \{
10. throw new AuthenticationException( "A CredentialsMatcher must be configured in order to verify " \+
11. "credentials during authentication. If you do not wish for credentials to be examined, you " \+
12. "can configure an " \+ AllowAllCredentialsMatcher.class.getName() + " instance.");
13. \}
14. \}

第一行获取CredentialsMatcher，如果不为空

第十步：调用CredentialsMatcher的doCredentialsMatch方法，当然CredentialsMatcher我们可以自定义了

第十一步：上面步骤都通过以后回到DefualtSecurityManager的login方法中

Subject loggedIn = createSubject(token, info, subject);

创建Subject

1.  protected Subject createSubject(AuthenticationToken token, AuthenticationInfo info, Subject existing)\{
2.  SubjectContext context = createSubjectContext();
3.  context.setAuthenticated( true);
4.  context.setAuthenticationToken(token);
5.  context.setAuthenticationInfo(info);
6.  if (existing != null) \{
7.  context.setSubject(existing);
8.  \}
9.  return createSubject(context);
10. \}

接着就是通过SubjectFactory生成subject，这里就不说了，就是从我们查询把我们查询到的用户身份信息关联到对应的subject中

[Center]: /images/20220520/3f65bdf7d4564eb8b7a6a428a6ae31a2.png