shiro认证流程源码分析--练气初期
写在前面
在上一篇文章当中，我们通过一个简单的例子，简单地认识了一下shiro。在这篇文章当中，我们将通过阅读源码的方式了解shiro的认证流程。
建议大家边读文章边动手调试代码，这样效果会更好。
认证异常分析
shiro中的异常主要分为两类，一类是AuthenticationException认证异常，一类是AuthorizationException权限异常。分别对应http响应状态码中的401和403
认证异常AuthenticationException子类
权限异常AuthorizationException子类
当认证不通过时将根据具体情况抛出AuthenticationException的子类，当鉴权不通过时将会抛出AuthorizationException的子类。
我们通过检验shiro是否抛出异常，从而判断登录对象是否通过认证、是否具备相关保护资源的访问权限。
这也是我们在上一节的例子中，需要捕获相关异常的原因。
接下来，我们通过阅读源码的方式来分析一下shiro框架的认证流程。
认证流程分析
/**认证器
* @author 赖柄沣 bingfengdev@aliyun.com
* @version 1.0
* @date 2020/9/21 0:50
*/
public class Authenticator {
private DefaultSecurityManager securityManager;
public Authenticator(){
//1. 创建安全管理器
this.securityManager = new DefaultSecurityManager();
//2. 给安全管理器设置问题域
//因为权限信息从ini文件中读取，所以是IniRealm
this.securityManager.setRealm(new IniRealm("classpath:shiro.ini"));
//3. 注入安全管理器，并使用SecurityUtils全局安全工具类完成认证
SecurityUtils.setSecurityManager(securityManager);
}
/**认证
* @author 赖柄沣 bingfengdev@aliyun.com
* @date 2020-09-23 16:22:11
* @param username 用户名
* @param password 密码
* @return void
* @version 1.0
*/
public void authenticate(String username,String password){
//4. 获取当前主题
Subject subject = SecurityUtils.getSubject();
//5.根据登录对象身份凭证信息创建登录令牌
UsernamePasswordToken token = new UsernamePasswordToken(username,password);
//6.认证
//如果认证通过，则不抛出异常，否则抛出AuthenticationExceptixon异常子类
//正式项目建议直接抛出，统一异常处理
try {
subject.login(token);
}catch (IncorrectCredentialsException e) {
e.printStackTrace();
}catch (ConcurrentAccessException e){
e.printStackTrace();
}catch (UnknownAccountException e){
e.printStackTrace();
}catch (ExcessiveAttemptsException e){
e.printStackTrace();
}catch (ExpiredCredentialsException e){
e.printStackTrace();
}catch (LockedAccountException e){
e.printStackTrace();
}
}
}
这是上一个例子当中的认证器的代码。 我们在上述代码的44行，shiro认证的入口处打个断点，以便跟踪其认证流程。
然后在idea中以debug的形式启动程序。
DelegatingSubject
login()方法
我们发现我们进入了DelegatingSubject.login方法当中；
public class DelegatingSubject implements Subject {
//省略了其他不影响理解的代码
public void login(AuthenticationToken token) throws AuthenticationException {
this.clearRunAsIdentitiesInternal();
// 1. 真正做认证的还是securityManager对象
Subject subject = this.securityManager.login(this, token);
String host = null;
PrincipalCollection principals;
if (subject instanceof DelegatingSubject) {
DelegatingSubject delegating = (DelegatingSubject)subject;
principals = delegating.principals;
host = delegating.host;
} else {
principals = subject.getPrincipals();
}
if (principals != null && !principals.isEmpty()) {
this.principals = principals;
this.authenticated = true;
if (token instanceof HostAuthenticationToken) {
host = ((HostAuthenticationToken)token).getHost();
}
if (host != null) {
this.host = host;
}
Session session = subject.getSession(false);
if (session != null) {
this.session = this.decorate(session);
} else {
this.session = null;
}
} else {
String msg = "Principals returned from securityManager.login( token ) returned a null or empty value. This value must be non null and populated with one or more elements.";
throw new IllegalStateException(msg);
}
}
}
从上面的源码中我们发现，虽然我们调用了Subject对象的认证方法，但是，真正的认证操作还是由安全管理器对象securityManager执行。
DefaultSecurityManager
login() 方法
接着，我们进入到securityManager的login方法当中去。
public class DefaultSecurityManager extends SessionsSecurityManager {
//省略了其他无关代码
public Subject login(Subject subject, AuthenticationToken token) throws AuthenticationException {
AuthenticationInfo info;
try {
//调用认证方法
info = this.authenticate(token);
} catch (AuthenticationException var7) {
AuthenticationException ae = var7;
try {
this.onFailedLogin(token, ae, subject);
} catch (Exception var6) {
if (log.isInfoEnabled()) {
log.info("onFailedLogin method threw an exception. Logging and propagating original AuthenticationException.", var6);
}
}
throw var7;
}
Subject loggedIn = this.createSubject(token, info, subject);
this.onSuccessfulLogin(token, info, loggedIn);
return loggedIn;
}
}
AuthenticatingSecurityManager
authenticate()方法
当我们进入到authenticate方法中时，发现他是AuthenticatingSecurityManager的方法
public abstract class AuthenticatingSecurityManager extends RealmSecurityManager {
//省略了其他无关代码
public AuthenticationInfo authenticate(AuthenticationToken token) throws AuthenticationException {
return this.authenticator.authenticate(token);
}
}
AbstractAuthenticator
authenticate()方法
接着，他又调用了authenticator对象的authenticate方法
public abstract class AbstractAuthenticator implements Authenticator, LogoutAware {
//省略了其他无关方法
public final AuthenticationInfo authenticate(AuthenticationToken token) throws AuthenticationException {
if (token == null) {
throw new IllegalArgumentException("Method argument (authentication token) cannot be null.");
} else {
log.trace("Authentication attempt received for token [{}]", token);
AuthenticationInfo info;
try {
info = this.doAuthenticate(token);
if (info == null) {
String msg = "No account information found for authentication token [" + token + "] by this Authenticator instance. Please check that it is configured correctly.";
throw new AuthenticationException(msg);
}
} catch (Throwable var8) {
AuthenticationException ae = null;
if (var8 instanceof AuthenticationException) {
ae = (AuthenticationException)var8;
}
if (ae == null) {
String msg = "Authentication failed for token submission [" + token + "]. Possible unexpected error? (Typical or expected login exceptions should extend from AuthenticationException).";
ae = new AuthenticationException(msg, var8);
if (log.isWarnEnabled()) {
log.warn(msg, var8);
}
}
try {
this.notifyFailure(token, ae);
} catch (Throwable var7) {
if (log.isWarnEnabled()) {
String msg = "Unable to send notification for failed authentication attempt - listener error?. Please check your AuthenticationListener implementation(s). Logging sending exception and propagating original AuthenticationException instead...";
log.warn(msg, var7);
}
}
throw ae;
}
log.debug("Authentication successful for token [{}]. Returned account [{}]", token, info);
this.notifySuccess(token, info);
return info;
}
}
}
ModularRealmAuthenticator
doAuthenticate()方法
紧接着进入到了ModularRealmAuthenticator认证器对象的doAuthenticate方法
public class ModularRealmAuthenticator extends AbstractAuthenticator {
protected AuthenticationInfo doAuthenticate(AuthenticationToken authenticationToken) throws AuthenticationException {
this.assertRealmsConfigured();
Collection<Realm> realms = this.getRealms();
return realms.size() == 1 ?
/**终于到了真正的认证逻辑*/ this.doSingleRealmAuthentication((Realm)realms.iterator().next(), authenticationToken) : this.doMultiRealmAuthentication(realms, authenticationToken);
}
}
在这一步当中，在检验我们的Realms对象创建后，开始进入到doSingleRealmAuthentication方法当中进行认证操作
doSingleRealmAuthentication()方法
protected AuthenticationInfo doSingleRealmAuthentication(Realm realm, AuthenticationToken token) {
if (!realm.supports(token)) {
String msg = "Realm [" + realm + "] does not support authentication token [" + token + "]. Please ensure that the appropriate Realm implementation is configured correctly or that the realm accepts AuthenticationTokens of this type.";
throw new UnsupportedTokenException(msg);
} else {
//获取认证信息
AuthenticationInfo info = realm.getAuthenticationInfo(token);
if (info == null) {
String msg = "Realm [" + realm + "] was unable to find account data for the submitted AuthenticationToken [" + token + "].";
throw new UnknownAccountException(msg);
} else {
return info;
}
}
}
AuthenticatingRealm
getAuthenticationInfo()方法
在这一步当中开始根据我们传入的令牌获取认证信息
public abstract class AuthenticatingRealm extends CachingRealm implements Initializable {
public final AuthenticationInfo getAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
// 首先从缓存中获取
AuthenticationInfo info = this.getCachedAuthenticationInfo(token);
if (info == null) {
//缓存中没有，则从持久化数据中获取
info = this.doGetAuthenticationInfo(token);
log.debug("Looked up AuthenticationInfo [{}] from doGetAuthenticationInfo", info);
if (token != null && info != null) {
this.cacheAuthenticationInfoIfPossible(token, info);
}
} else {
log.debug("Using cached authentication info [{}] to perform credentials matching.", info);
}
if (info != null) {
this.assertCredentialsMatch(token, info);
} else {
log.debug("No AuthenticationInfo found for submitted AuthenticationToken [{}]. Returning null.", token);
}
return info;
}
}
SimpleAccountRealm
doGetAuthenticationInfo()方法
从持久化数据源中获取登录对象信息
public class SimpleAccountRealm extends AuthorizingRealm {
protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
UsernamePasswordToken upToken = (UsernamePasswordToken)token;
//根据用户名查询账户信息
SimpleAccount account = this.getUser(upToken.getUsername());
//如果查询到了账户信息
if (account != null) {
//开始判断账户状态
if (account.isLocked()) {
throw new LockedAccountException("Account [" + account + "] is locked.");
}
if (account.isCredentialsExpired()) {
String msg = "The credentials for account [" + account + "] are expired";
throw new ExpiredCredentialsException(msg);
}
}
return account;
}
}
在这里，便完成了对用户名的校验。
AuthenticatingRealm
接下来，我们获取到了账户信息并返回到了AuthenticatingRealm的getAuthenticationInfo方法。
在这个方法中有如下几行代码，在第二行中，调用assertCredentialsMatch方法开始校验用户凭证
if (info != null) {
this.assertCredentialsMatch(token, info);
} else {
log.debug("No AuthenticationInfo found for submitted AuthenticationToken [{}]. Returning null.", token);
}
assertCredentialsMatch()方法
protected void assertCredentialsMatch(AuthenticationToken token, AuthenticationInfo info) throws AuthenticationException {
//获取凭证匹配器对象
CredentialsMatcher cm = this.getCredentialsMatcher();
if (cm != null) {
if (!cm.doCredentialsMatch(token, info)) {
String msg = "Submitted credentials for token [" + token + "] did not match the expected credentials.";
throw new IncorrectCredentialsException(msg);
}
} else {
throw new AuthenticationException("A CredentialsMatcher must be configured in order to verify credentials during authentication. If you do not wish for credentials to be examined, you can configure an " + AllowAllCredentialsMatcher.class.getName() + " instance.");
}
}
在这里完成对用户凭证的校验。真正的比较逻辑则在SimpleCredentialsMatcher的equals方法中完成。里面还会区分加密和不加密的情况，具体请查看源码。
分析到这一步我们可以发现，SimpleAccountRealm继承了AuthorizingRealm类实现doGetAuthenticationInfo方法完成账户信息查询并校验，并将结果返回给AuthorizingRealm。AuthorizingRealm帮SimpleAccountRealm完成对用户凭证的校验。
那么，如果我们需要从数据库当中获取账户信息，应该怎么将账户信息传给shiro进行验证呢？这个问题留给大家思考一下，我将在下一篇文章当中为大家解答。
写在最后
在这篇文章当中，我们通过断点调试，阅读源码的方式弄清楚了shiro的认证流程。我们拆开他的层层封装，发现在SimpleAccountRealm对象中的doGetAuthenticationInfo方法中完成账户验证，在AuthenticatingRealm的assertCredentialsMatch完成对用户凭证的校验。
在下一篇文章当中，我们将学习如何使用数据库信息完成认证和授权。
