Shiro 官方文档之shiro术语

古城微笑少年丶 2024-02-19 12:41 54阅读 0赞

## Apache Shiro Terminology ##

Please just take 2 minutes to read and understand this - it is really important. Really. The terms and concepts here are referred to everywhere in the documentation and it will greatly simplify your understanding of Shiro and security in general.

请话费2分钟阅读和理解这个——这真的很重要。这里的术语和概念在文档中随处可见，它极大的简化了你对shiro和安全的理解。

Security can be really confusing because of the terminology used. We’ll make life easier by clarifying some core concepts and you’ll see how nicely the Shiro API reflects them.

安全作为专业术语可能真的会让人感到迷惑。我们会通过澄清一些核心的概念让你觉得很容易（对于安全、shiro），你将会看到Shori是如何很好的反映他们的。

Authentication（认证）  
Authentication is the process of verifying a Subject’s identity - essentially proving that someone really is who they say they are. When an authentication attempt is successful the application can trust that the subject is guaranteed to be who the application expects.

Authentication是核查Subject的身份的程序，本质上是证明他们说的那个人到底是谁。当一个认证尝试是成功的，这个程序可以相信这个被保证为应用程序所期望的对象。（认证通过，就能进入系统的意思）

Authorization (授权)  
Authorization, also known as Access Control, is the process of determining if a user/Subject is allowed to do something or not. It is usually accomplished by inspecting and interpreting a Subject’s roles and permissions (see below) and then allowing or denying access to a requested resource or function.

Authorization，也是访问控制，它是用来决定一个用户是否被允许做某些事（就是是否有权限做某些事）。它通常由检查和解释一个用户的角色和权限来完成这个是否被允许或者拒绝请求一个资源或函数。

Cipher (密码)  
A cipher is an algorithm for performing encryption or decryption. The algorithm generally relies on a piece of information called a key. And the encryption varies based on the key so decyrption is extremely difficult without it.

cipher是一个用来执行加密或解密的算法。这个算法通常依赖一段称为密钥的信息。加密基于不同的key，如果没有这个key解密会变得非常困难。

Ciphers come in different variations. Block Ciphers work on blocks of symbols usually of a fixed size while Stream Ciphers work on a continuous stream of symbols. Symmetric Ciphers use the same key for encryption and decryption while Asymmetric Ciphers use different keys. And if a key in an asymmetric cipher cannot be derived from the other, then one can be shared publicly creating public/private key pairs.

密码有多种不同的变体。块密码通常作用于固定大小的符号块，而流密码作用于连续的符号流。对称密码使用相同的密钥进行加密和解密，而非对称密码使用不同的密钥。如果不对称密码中的密钥不能从另一个密钥派生，那么可以公开共享一个密钥，以创建公共/私有密钥对。

Credential (证书)  
A Credential is a piece of information that verifies the identity of a user/Subject. One (or more) credentials are submitted along with Principal(s) during an authentication attempt to verify that the user/Subject submitting them is actually the associated user. Credentials are usually very secret things that only a particular user/Subject would know, such as a password or a PGP key or biometric attribute or similar mechanism.  
The idea is that for a principal, only one person would know the correct credential to ‘pair’ with that principal. If the current user/Subject provides the correct credential matching the one stored in the system, then the system can assume and trust that the current user/Subject is really who they say they are. The degree of trust increases with more secure credential types (e.g. biometric signature > password).

凭证是验证用户/Subject身份的信息片段。在身份验证尝试验证提交凭证的用户/Subject实际上是相关用户时，会连同Principal一起提交一个(或多个)凭证。凭证通常是只有特定的用户/主体才知道的非常机密的东西，例如密码、PGP密钥、生物特征属性或类似机制。  
其理念是，对于校长来说，只有一个人知道与他“配对”的正确证书。如果当前用户/主题提供了与系统中存储的证书匹配的正确凭据，那么系统就可以假设并信任当前用户/主题就是他们所说的那样。信任程度随着更安全的凭证类型(例如生物特征签名>密码)的增加而增

Cryptography (密码学,密码使用法)  
Cryptography is the practice of protecting information from undesired access by hiding it or converting it into nonsense so no one else can read it. Shiro focuses on two core elements of Cryptography: ciphers that encrypt data like email using a public or private key, and hashes (aka message digests) that irreversibly encrypt data like passwords.

密码学是一种通过隐藏信息或将其转换成无意义信息以防止不希望访问的信息，这样其他人就无法读取它。Shiro专注于加密技术的两个核心元素:使用公共或私钥加密数据(如电子邮件)的密码和不可逆转加密数据(如密码)的哈希(又名消息摘要)。

Hash （哈希）  
A Hash function is a one-way, irreversible conversion of an input source, sometimes called the message, into an encoded hash value, sometimes called the message digest. It is often used for passwords, digital fingerprints, or data with an underlying byte array.

哈希函数是输入源(有时称为消息)向编码哈希值(有时称为消息摘要)的单向、不可逆转换。它通常用于密码、数字指纹或具有底层字节数组的数据。

Permission （权限）  
A Permission, at least as Shiro interprets it, is a statement that describes raw functionality in an application and nothing more. Permissions are the lowest-level constructs in security policies. They define only “What” the application can do. They do not describe “Who” is able to perform the actions. A Permission is only a statement of behavior, nothing more.

权限(至少像Shiro解释的那样)是描述应用程序中原始功能的语句，仅此而已。权限是安全策略中的最低级别构造。它们只定义应用程序可以做什么。他们没有描述“谁”能够执行这些动作。许可只是行为的陈述，仅此而已。

Some examples of permissions:

Open a file  
View the ‘/user/list’ web page  
Print documents  
Delete the ‘jsmith’ user

Principal(当事人)  
A Principal is any identifying attribute of an application user (Subject). An ‘identifying attribute’ can be anything that makes sense to your application - a username, a surname, a given name, a social security number, a user ID, etc. That’s it - nothing crazy.

Principal是应用程序用户(主题)的任何标识属性。“标识属性”可以是任何对应用程序有意义的东西——用户名、姓氏、给定姓名、社会保险号、用户ID等等。

Shiro also references something we call a Subject’s primary principal. A Primary principal is any principal that uniquely identifies the Subject across the entire application. Ideal primary principals are things like a username or a user ID that is a RDBMS user table primary key. There is only one primary principal for users (Subjects) in an application.

Shiro还引用了我们所说的principal的主要原则。主principal是在整个应用程序中唯一标识主题的principal。理想的主principal是用户名或用户ID，它们是RDBMS用户表主键。应用程序中只有一个用户(Subjects)的主要principal。

Realm (范围、领域)  
A Realm is a component that can access application-specific security data such as users, roles, and permissions. It can be thought of as a security-specific DAO (Data Access Object). The Realm translates this application-specific data into a format that Shiro understands so Shiro can in turn provide a single easy-to-understand Subject programming API no matter how many data sources exist or how application-specific your data might be.

领域是可以访问特定于应用程序的安全数据(如用户、角色和权限)的组件。它可以被认为是安全特定的DAO(数据访问对象)。领域将这种特定于应用程序的数据转换为Shiro能够理解的格式，这样Shiro就可以提供一个易于理解的主题编程API，而不管存在多少数据源或数据的应用程序特定程度如何。

Realms usually have a 1-to-1 correlation with a data source such as a relational database, LDAP directory, file system, or other similar resource. As such, implementations of the Realm interface use data source-specific APIs to discover authorization data (roles, permissions, etc), such as JDBC, File IO, Hibernate or JPA, or any other Data Access API.

领域通常与数据源(如关系数据库、LDAP目录、文件系统或其他类似资源)有1比1的相关性。因此，领域接口的实现使用特定于数据源的API来发现授权数据(角色、权限等)，例如JDBC、文件IO、Hibernate或JPA，或任何其他数据访问API。

Role （角色）  
The definition of a Role can vary based on who you talk to. In many applications it is a nebulous concept at best that people use to implicitly define security policies. Shiro prefers to interpret a Role as simply a named collection of Permissions. That’s it - an application unique name aggregating one or more Permission declarations.

角色的定义可能会因与谁交谈而有所不同。在许多应用程序中，它充其量是一个模糊的概念，人们用它来隐式地定义安全策略。Shiro更喜欢将角色简单地解释为一个命名的权限集合。就是这样——聚合一个或多个权限声明的应用程序惟一名称。

This is a more concrete definition than the implicit one used by many applications. If you choose to have your data model reflect Shiro’s assumption, you’ll find you will have much more power in controlling security policies.

这是一个比许多应用程序使用的隐式定义更具体的定义。如果您选择让您的数据模型反映Shiro的假设，您会发现您在控制安全策略方面拥有更大的权力。

Session （会话）  
A Session is a stateful data context associated with a single user/Subject who interacts with a software system over a period of time. Data can be added/read/removed from the Session while the subject uses the application and the application can use this data later where necessary. Sessions are terminated when the user/Subject logs out of the application or when it times out due to inactivity.

会话是与单个用户/主题相关联的有状态数据上下文，该用户/主题在一段时间内与软件系统进行交互。在主题使用应用程序时，可以从会话中添加/读取/删除数据，应用程序可以在以后需要时使用这些数据。当用户/主题退出应用程序或由于不活动而超时时，会话将终止。

For those familiar with the HttpSession, a Shiro Session serves the same purpose, except Shiro sessions can be used in any environment even if there is no Servlet container or EJB container available.

对于那些熟悉HttpSession的人来说，Shiro会话的作用是相同的，除了Shiro会话可以在任何环境中使用，即使没有Servlet容器或EJB容器可用。

Subject （主题）  
A Subject is just fancy security term that basically means a security-specific ‘view’ of an application user. A Subject does not always need to reflect a human being though - it can represent an external process calling your application, or perhaps a daemon system account that executes something intermittently over a period of time (such as a cron job). It is basically a representation of any entity that is doing something with the application.

主题只是一个花哨的安全术语，基本上是指应用程序用户的特定于安全的“视图”。但是，主题并不总是需要反映一个人——它可以表示调用应用程序的外部进程，也可以表示在一段时间内间歇性执行某些任务的守护进程系统帐户(例如cron作业)。它基本上是应用程序中执行某些操作的任何实体的表示。

Lend a hand with documentation 帮忙整理文件  
While we hope this documentation helps you with the work you’re doing with Apache Shiro, the community is improving and expanding the documentation all the time. If you’d like to help the Shiro project, please consider correcting, expanding, or adding documentation where you see a need. Every little bit of help you provide expands the community and in turn improves Shiro.

虽然我们希望这些文档可以帮助您完成Apache Shiro的工作，但是社区一直在改进和扩展这些文档。如果您想帮助Shiro项目，请考虑在需要的地方修改、扩展或添加文档。你提供的每一点帮助都能扩展社区，进而改善Shiro。

The easiest way to contribute your documentation is to send it to the User Forum or the User Mailing List.

提交文档的最简单方法是将其发送到用户论坛或用户邮件列表。