apache shiro （1）理论

秒速五厘米 2023-07-09 06:27 18阅读 0赞

## 认证 ##

**身份认证流程**

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM3NzY5MzIz_size_16_color_FFFFFF_t_70][]

**流程如下**：

1、首先调用 Subject.login(token)进行登录，其会自动委托给 Security Manager，调用之前必 须通过 SecurityUtils. setSecurityManager()设置；

2、SecurityManager 负责真正的身份验证逻辑；它会委托给 Authenticator 进行身份验证；

3、Authenticator 才是真正的身份验证者，Shiro API 中核心的身份认证入口点，此处可以自 定义插入自己的实现；

4、Authenticator 可能会委托给相应的 AuthenticationStrategy 进行多 Realm 身份验证，默认 ModularRealmAuthenticator 会调用 AuthenticationStrategy 进行多 Realm 身份验证；

5、Authenticator 会把相应的 token 传入 Realm，从 Realm 获取身份验证信息，如果没有返 回/抛出异常表示身份验证失败了。此处可以配置多个 Realm，将按照相应的顺序及策略进 行访问。

**Realm 源码：**

package org.apache.shiro.realm;
    
    import org.apache.shiro.authc.AuthenticationException;
    import org.apache.shiro.authc.AuthenticationInfo;
    import org.apache.shiro.authc.AuthenticationToken;
    
    public interface Realm {
    
        //返回一个唯一的 Realm 名字
        String getName(); 
        
        //判断此 Realm 是否支持此 Token
        boolean supports(AuthenticationToken token);
    
        //根据 Token 获取认证信息
        AuthenticationInfo getAuthenticationInfo(AuthenticationToken token) throws AuthenticationException;
    
    }

**自定义Realm实现**

package com.github.zhangkaitao.shiro.chapter2.realm;
 
 import org.apache.shiro.authc.*;
 import org.apache.shiro.realm.Realm;
 
 import java.util.List;
 
 /**
 * User: Zhang Kaitao
 * Date: 14-1-25
 * Version: 1.0
 */
 public class MyRealm1 implements Realm {
 
 @Override
 public String getName() {
 return "myrealm1";
 }
 
 @Override
 public boolean supports(AuthenticationToken token) {
 return token instanceof UsernamePasswordToken; //仅支持UsernamePasswordToken类型的Token
 }
 
 @Override
 public AuthenticationInfo getAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
 
 String username = (String)token.getPrincipal(); //得到用户名
 String password = new String((char[])token.getCredentials()); //得到密码
 if(!"zhang".equals(username)) {
 throw new UnknownAccountException(); //如果用户名错误
 }
 if(!"123".equals(password)) {
 throw new IncorrectCredentialsException(); //如果密码错误
 }
 //如果身份认证验证成功，返回一个AuthenticationInfo实现；
 return new SimpleAuthenticationInfo(username, password, getName());
 }
 }

**Shiro 默认提供的 Realm**

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM3NzY5MzIz_size_16_color_FFFFFF_t_70 1][]

以后一般继承 AuthorizingRealm（授权）即可；其继承了 AuthenticatingRealm（即身份验证）， 而且也间接继承了 CachingRealm（带有缓存实现）。

\------

**Authenticator 及 AuthenticationStrategy**

Authenticator 的职责是验证用户帐号，是 Shiro API 中身份验证核心的入口点：

![20200228110150573.png][]

如果验证成功，将返回 AuthenticationInfo 验证信息；此信息中包含了身份及凭证；如果验 证失败将抛出相应的 AuthenticationException 实现。

SecurityManager 接口继承了 Authenticator，另外还有一个 ModularRealmAuthenticator 实现， 其委托给多个 Realm 进行验证，验证规则通过 AuthenticationStrategy 接口指定，默认提供 的实现：

FirstSuccessfulStrategy：只要有一个 Realm 验证成功即可，只返回第一个 Realm 身份验证 成功的认证信息，其他的忽略；

AtLeastOneSuccessfulStrategy：只要有一个 Realm 验证成功即可，和 FirstSuccessfulStrategy 不同，返回所有 Realm 身份验证成功的认证信息；

AllSuccessfulStrategy：所有 Realm 验证成功才算成功，且返回所有 Realm 身份验证成功的 认证信息，如果有一个失败就失败了。

ModularRealmAuthenticator 默认使用 AtLeastOneSuccessfulStrategy 策略。

\------

## 授权 ##

“RBAC”和“RBAC 新解”分别了解“基于角色的访问控制”“基于资源 的访问控制(Resource-Based Access Control)”

Authorizer 的职责是进行授权（访问控制），是 Shiro API 中授权核心的入口点，其提供了 相应的角色/权限判断接口

\------

## 编码/解码 ##

Shiro 提供了 base64 和 16 进制字符串编码/解码的 API 支持，方便一些编码解码操作。Shiro 内部的一些数据的存储/表示都使用了 base64 和 16 进制字符串。

String str = "hello"; 
    
    String base64Encoded = Base64.encodeToString(str.getBytes()); 
    
    String str2 = Base64.decodeToString(base64Encoded); 
    
    Assert.assertEquals(str, str2);

通过如上方式可以进行 base64 编码/解码操作

String str = "hello"; 
    
    String base64Encoded = Hex.encodeToString(str.getBytes()); 
    
    String str2 = new String(Hex.decode(base64Encoded.getBytes())); 
    
    Assert.assertEquals(str, str2);

通过如上方式可以进行 16 进制字符串编码/解码操作

还有一个可能经常用到的类 CodecSupport，提供了 toBytes(str, "utf-8") / toString(bytes, "utf-8")用于在 byte 数组/String 之间转换。

**Md5Hash**

package org.apache.shiro.crypto.hash;
    
    import org.apache.shiro.codec.Base64;
    import org.apache.shiro.codec.Hex;
    
    public class Md5Hash extends SimpleHash {
    
    
        public static final String ALGORITHM_NAME = "MD5";
    
        public Md5Hash() {
            super(ALGORITHM_NAME);
        }
    
        public Md5Hash(Object source) {
            super(ALGORITHM_NAME, source);
        }
    
        public Md5Hash(Object source, Object salt) {
            super(ALGORITHM_NAME, source, salt);
        }
    
        public Md5Hash(Object source, Object salt, int hashIterations) {
            super(ALGORITHM_NAME, source, salt, hashIterations);
        }
    
        public static Md5Hash fromHexString(String hex) {
            Md5Hash hash = new Md5Hash();
            hash.setBytes(Hex.decode(hex));
            return hash;
        }
    
        public static Md5Hash fromBase64String(String base64) {
            Md5Hash hash = new Md5Hash();
            hash.setBytes(Base64.decode(base64));
            return hash;
        }
    }

package org.apache.shiro.crypto.hash;
    
    import org.apache.shiro.codec.Base64;
    import org.apache.shiro.codec.Hex;
    
    public class Sha256Hash extends SimpleHash {
    
    
        public static final String ALGORITHM_NAME = "SHA-256";
    
        public Sha256Hash() {
            super(ALGORITHM_NAME);
        }
    
        public Sha256Hash(Object source) {
            super(ALGORITHM_NAME, source);
        }
    
        public Sha256Hash(Object source, Object salt) {
            super(ALGORITHM_NAME, source, salt);
        }
    
        public Sha256Hash(Object source, Object salt, int hashIterations) {
            super(ALGORITHM_NAME, source, salt, hashIterations);
        }
    
        public static Sha256Hash fromHexString(String hex) {
            Sha256Hash hash = new Sha256Hash();
            hash.setBytes(Hex.decode(hex));
            return hash;
        }
    
        public static Sha256Hash fromBase64String(String base64) {
            Sha256Hash hash = new Sha256Hash();
            hash.setBytes(Base64.decode(base64));
            return hash;
        }
    }

使用 SHA256 算法生成相应的散列数据，另外还有如 SHA1、SHA512 算法。

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM3NzY5MzIz_size_16_color_FFFFFF_t_70 2][]

Shiro 还提供对称式加密/解密算法的支持，如 AES、Blowfish 等；当前还没有提供对非对 称加密/解密算法支持，未来版本可能提供。

package com.github.zhangkaitao.shiro.chapter5.hash;
 
 import junit.framework.Assert;
 import org.apache.shiro.codec.Base64;
 import org.apache.shiro.codec.CodecSupport;
 import org.apache.shiro.codec.Hex;
 import org.apache.shiro.crypto.*;
 import org.apache.shiro.crypto.hash.*;
 import org.apache.shiro.util.ByteSource;
 import org.apache.shiro.util.SimpleByteSource;
 import org.junit.Test;
 
 import javax.crypto.Cipher;
 import java.security.*;
 import java.security.interfaces.RSAPrivateKey;
 import java.security.spec.EncodedKeySpec;
 import java.security.spec.PKCS8EncodedKeySpec;
 import java.security.spec.RSAPrivateKeySpec;
 import java.security.spec.X509EncodedKeySpec;
 
 /**
 * User: Zhang Kaitao
 * Date: 14-1-27
 * Version: 1.0
 */
 public class CodecAndCryptoTest {
 
 
 
 @Test
 public void testBase64() {
 String str = "hello";
 String base64Encoded = Base64.encodeToString(str.getBytes());
 String str2 = Base64.decodeToString(base64Encoded);
 Assert.assertEquals(str, str2);
 
 }
 
 @Test
 public void testHex() {
 String str = "hello";
 String base64Encoded = Hex.encodeToString(str.getBytes());
 String str2 = new String(Hex.decode(base64Encoded.getBytes()));
 Assert.assertEquals(str, str2);
 
 }
 
 @Test
 public void testCodecSupport() {
 String str = "hello";
 byte[] bytes = CodecSupport.toBytes(str, "utf-8");
 String str2 = CodecSupport.toString(bytes, "utf-8");
 Assert.assertEquals(str, str2);
 }
 
 
 @Test
 public void testRandom() {
 //生成随机数
 SecureRandomNumberGenerator randomNumberGenerator = new SecureRandomNumberGenerator();
 randomNumberGenerator.setSeed("123".getBytes());
 System.out.println(randomNumberGenerator.nextBytes().toHex());
 }
 
 
 
 @Test
 public void testMd5() {
 String str = "hello";
 String salt = "123";
 String md5 = new Md5Hash(str, salt).toString();//还可以转换为 toBase64()/toHex()
 System.out.println(md5);
 
 
 }
 
 @Test
 public void testSha1() {
 String str = "hello";
 String salt = "123";
 String sha1 = new Sha1Hash(str, salt).toString();
 System.out.println(sha1);
 
 }
 
 @Test
 public void testSha256() {
 String str = "hello";
 String salt = "123";
 String sha1 = new Sha256Hash(str, salt).toString();
 System.out.println(sha1);
 
 }
 
 @Test
 public void testSha384() {
 String str = "hello";
 String salt = "123";
 String sha1 = new Sha384Hash(str, salt).toString();
 System.out.println(sha1);
 
 }
 
 @Test
 public void testSha512() {
 String str = "hello";
 String salt = "123";
 String sha1 = new Sha512Hash(str, salt).toString();
 System.out.println(sha1);
 
 }
 
 @Test
 public void testSimpleHash() {
 String str = "hello";
 String salt = "123";
 //MessageDigest
 String simpleHash = new SimpleHash("SHA-1", str, salt).toString();
 System.out.println(simpleHash);
 
 }
 
 
 
 @Test
 public void testHashService() {
 DefaultHashService hashService = new DefaultHashService(); //默认算法SHA-512
 hashService.setHashAlgorithmName("SHA-512");
 hashService.setPrivateSalt(new SimpleByteSource("123")); //私盐，默认无
 hashService.setGeneratePublicSalt(true);//是否生成公盐，默认false
 hashService.setRandomNumberGenerator(new SecureRandomNumberGenerator());//用于生成公盐。默认就这个
 hashService.setHashIterations(1); //生成Hash值的迭代次数
 
 HashRequest request = new HashRequest.Builder()
 .setAlgorithmName("MD5").setSource(ByteSource.Util.bytes("hello"))
 .setSalt(ByteSource.Util.bytes("123")).setIterations(2).build();
 String hex = hashService.computeHash(request).toHex();
 System.out.println(hex);
 }
 
 
 @Test
 public void testAesCipherService() {
 AesCipherService aesCipherService = new AesCipherService();
 aesCipherService.setKeySize(128);//设置key长度
 
 //生成key
 Key key = aesCipherService.generateNewKey();
 
 String text = "hello";
 
 //加密
 String encrptText = aesCipherService.encrypt(text.getBytes(), key.getEncoded()).toHex();
 //解密
 String text2 = new String(aesCipherService.decrypt(Hex.decode(encrptText), key.getEncoded()).getBytes());
 
 Assert.assertEquals(text, text2);
 }
 
 @Test
 public void testBlowfishCipherService() {
 BlowfishCipherService blowfishCipherService = new BlowfishCipherService();
 blowfishCipherService.setKeySize(128);
 
 //生成key
 Key key = blowfishCipherService.generateNewKey();
 
 String text = "hello";
 
 //加密
 String encrptText = blowfishCipherService.encrypt(text.getBytes(), key.getEncoded()).toHex();
 //解密
 String text2 = new String(blowfishCipherService.decrypt(Hex.decode(encrptText), key.getEncoded()).getBytes());
 
 Assert.assertEquals(text, text2);
 }
 
 @Test
 public void testDefaultBlockCipherService() throws Exception {
 
 
 //对称加密，使用Java的JCA（javax.crypto.Cipher）加密API，常见的如 'AES', 'Blowfish'
 DefaultBlockCipherService cipherService = new DefaultBlockCipherService("AES");
 cipherService.setKeySize(128);
 
 //生成key
 Key key = cipherService.generateNewKey();
 
 String text = "hello";
 
 //加密
 String encrptText = cipherService.encrypt(text.getBytes(), key.getEncoded()).toHex();
 //解密
 String text2 = new String(cipherService.decrypt(Hex.decode(encrptText), key.getEncoded()).getBytes());
 
 Assert.assertEquals(text, text2);
 }
 
 
 //加密/解密相关知识可参考snowolf的博客 http://snowolf.iteye.com/category/68576
 
 
 }

**Shiro 提供了 PasswordService 及 CredentialsMatcher 用于提供加密密码及验证密码服务。**

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM3NzY5MzIz_size_16_color_FFFFFF_t_70 3][]

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM3NzY5MzIz_size_16_color_FFFFFF_t_70 4][]

**密码重试次数限制**

package com.github.zhangkaitao.shiro.chapter5.hash.credentials;
 
 import net.sf.ehcache.CacheManager;
 import net.sf.ehcache.Ehcache;
 import net.sf.ehcache.Element;
 import org.apache.shiro.authc.AuthenticationInfo;
 import org.apache.shiro.authc.AuthenticationToken;
 import org.apache.shiro.authc.ExcessiveAttemptsException;
 import org.apache.shiro.authc.UnknownAccountException;
 import org.apache.shiro.authc.credential.HashedCredentialsMatcher;
 
 import javax.security.auth.login.AccountLockedException;
 import java.util.concurrent.atomic.AtomicInteger;
 
 /**
 * User: Zhang Kaitao
 * Date: 14-1-28
 * Version: 1.0
 */
 public class RetryLimitHashedCredentialsMatcher extends HashedCredentialsMatcher {
 
 private Ehcache passwordRetryCache;
 
 public RetryLimitHashedCredentialsMatcher() {
 CacheManager cacheManager = CacheManager.newInstance(CacheManager.class.getClassLoader().getResource("ehcache.xml"));
 passwordRetryCache = cacheManager.getCache("passwordRetryCache");
 }
 
 @Override
 public boolean doCredentialsMatch(AuthenticationToken token, AuthenticationInfo info) {
 String username = (String)token.getPrincipal();
 //retry count + 1
 Element element = passwordRetryCache.get(username);
 if(element == null) {
 element = new Element(username , new AtomicInteger(0));
 passwordRetryCache.put(element);
 }
 AtomicInteger retryCount = (AtomicInteger)element.getObjectValue();
 if(retryCount.incrementAndGet() > 5) {
 //if retry count > 5 throw
 throw new ExcessiveAttemptsException();
 }
 
 boolean matches = super.doCredentialsMatch(token, info);
 if(matches) {
 //clear retry count
 passwordRetryCache.remove(username);
 }
 return matches;
 }
 }

[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM3NzY5MzIz_size_16_color_FFFFFF_t_70]: https://img-blog.csdnimg.cn/20200228103403804.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM3NzY5MzIz,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM3NzY5MzIz_size_16_color_FFFFFF_t_70 1]: https://img-blog.csdnimg.cn/20200228105404340.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM3NzY5MzIz,size_16,color_FFFFFF,t_70
[20200228110150573.png]: https://img-blog.csdnimg.cn/20200228110150573.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM3NzY5MzIz_size_16_color_FFFFFF_t_70 2]: https://img-blog.csdnimg.cn/20200228114342524.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM3NzY5MzIz,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM3NzY5MzIz_size_16_color_FFFFFF_t_70 3]: https://img-blog.csdnimg.cn/20200228114917150.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM3NzY5MzIz,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM3NzY5MzIz_size_16_color_FFFFFF_t_70 4]: https://img-blog.csdnimg.cn/20200228115917564.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM3NzY5MzIz,size_16,color_FFFFFF,t_70