Shiro框架 filter&realm绑定

这种实现方式有问题，会影响到后续的角色验证。不建议看了

新的实现方式 ： 自定义Token

---

• shiro filter与Realm绑定
• 使用Spring整合Shiro
• 多登陆入口，成功后跳转到不同地址
• 重写Realm获取方式

---

最近在项目中使用了apache的轻量级Shiro框架进行权限管理，使用了多个filter，Shiro会默认迭代Realm进行登陆，即使第一个Realm通过校验，也会继续迭代，造成性能的浪费，和数据库查询。又或者前Realm里做了一些校验，抛出了异常，也会被后面的无用的Realm校验失败抛出的一场覆盖。

---

不废话，上教程不废话，上教程
注意：这里filter统一指shiro 定义的filter
至于servlet的filter会写成 servlet filter

这是先前的配置

已经实现方式赋予Realm对应的role角色，已经有多入口，前后台分开的功能，

<bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
        <!-- shiro 的核心安全接口 -->
        <property name="securityManager" ref="securityManager" />
        <!-- 未授权时要跳转的连接 -->
        <property name="unauthorizedUrl" value="/unauthorized.jsp" />
        <property name="filters">
            <map>
                <entry key="admin" value-ref="adminformAuthenticationFilter" />
                <entry key="authc" value-ref="formAuthenticationFilter" />
            </map>
        </property>
        <!-- shiro 连接约束配置 -->
        <property name="filterChainDefinitions">
            <value>
                /user.html = authc
                /admin.html =authc
                /login.html = authc
                /admin/login.html =admin
                /logout = logout
                /resource/** = anon
            </value>
        </property>
    </bean>

    <bean id="formAuthenticationFilter"
        class="org.apache.shiro.web.filter.authc.FormAuthenticationFilter">
        <property name="loginUrl" value="/login.html" />
        <property name="successUrl" value="/ok.html" />
    </bean>
    <bean id="adminformAuthenticationFilter"
        class="org.apache.shiro.web.filter.authc.FormAuthenticationFilter">
        <property name="loginUrl" value="/admin/login.html" />
        <property name="successUrl" value="/admin/ok.html" />
    </bean>
    <bean id="AdminRealm" class="cc.yihy.realm.AdminRealm">
        <property name="userService" ref="UserService" />
    </bean>
    <bean id="UserRealm" class="cc.yihy.realm.UserRealm">
        <property name="userService" ref="UserService" />
    </bean>

    <!-- 安全管理器 -->
    <bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
    <!-- 默认的Realm验证 -->
        <property name="realms">
            <list>
                <ref bean="UserRealm" />
                <ref bean="AdminRealm"></ref>
            </list>
        </property>
    </bean>
    <bean id="lifecycleBeanPostProcessor" class="org.apache.shiro.spring.LifecycleBeanPostProcessor" />

---

在我们点击登陆后，Shiro会使用我们配置的FormAuthenticationFilter进行验证。

执行

//父类里实现的方法
protected boolean executeLogin(ServletRequest request, ServletResponse response) throws Exception {
    //这里创建用户的令牌
        AuthenticationToken token = createToken(request, response);
        if (token == null) {
            String msg = "createToken method implementation returned null. A valid non-null AuthenticationToken " +
                    "must be created in order to execute a login attempt.";
            throw new IllegalStateException(msg);
        }
        try {
            Subject subject = getSubject(request, response);
            //在这里进行登陆验证
            subject.login(token);
            return onLoginSuccess(token, subject, request, response);
        } catch (AuthenticationException e) {
            return onLoginFailure(token, e, request, response);
        }
    }

      protected AuthenticationToken createToken(ServletRequest request, ServletResponse response) {
        String username = getUsername(request);
        String password = getPassword(request);
        return createToken(username, password, request, response);
    }
    //父类的创建令牌的实现
     protected AuthenticationToken createToken(String username, String password,
                                              ServletRequest request, ServletResponse response) {
        boolean rememberMe = isRememberMe(request);
        String host = getHost(request);
        return createToken(username, password, rememberMe, host);
    }
    //父类的创建令牌的实现
   protected AuthenticationToken createToken(String username, String password,
                                              boolean rememberMe, String host) {
        return new UsernamePasswordToken(username, password, rememberMe, host);
    }

subject.login(token);的实现类里，又调用了安全管理器的login。传的对象是一个Token令牌。

再看看安全管理器里面是怎么进行登录的

Subject subject = securityManager.login(this, token);

 //安全管理器实现类DefaultSecurityManager里面的login
public Subject login(Subject subject, AuthenticationToken token) throws AuthenticationException {
      //
        AuthenticationInfo info;
        try {
            info = authenticate(token);
        } catch (AuthenticationException ae) {
            try {
                onFailedLogin(token, ae, subject);
            } catch (Exception e) {
                if (log.isInfoEnabled()) {
                    log.info("onFailedLogin method threw an " +
                            "exception.  Logging and propagating original AuthenticationException.", e);
                }
            }
            throw ae; //propagate
        }

        Subject loggedIn = createSubject(token, info, subject);

        onSuccessfulLogin(token, info, loggedIn);

        return loggedIn;
    }
  //这是它的父类里面 
   private Authenticator authenticator;

   public AuthenticationInfo authenticate(AuthenticationToken token) throws AuthenticationException {
       //真正进行登陆Realm的在这里
        return this.authenticator.authenticate(token);
    }

还是看下Authenticator接口实现类（ModularRealmAuthenticator）的源码

 这是配置的Realm集合
private Collection<Realm> realms;
//迭代Realm进行验证
   protected AuthenticationInfo doAuthenticate(AuthenticationToken authenticationToken) throws AuthenticationException {
        assertRealmsConfigured();
        Collection<Realm> realms = getRealms();
        if (realms.size() == 1) {
            return doSingleRealmAuthentication(realms.iterator().next(), authenticationToken);
        } else {
            return doMultiRealmAuthentication(realms, authenticationToken);
        }
    }

到这里，filter调用realm进行验证的流程基本已经清晰了。

filter创建一个Token对象，传到安全管理器（securityManager），让安全管理器调用Authenticator属性进行迭代Realm。
怎么让Filter找到对应权限的realm呢？他们中间传递一一个对象Token令牌。
Token里放了这些基本信息
new UsernamePasswordToken(username, password, rememberMe, host)；

从filter到realm并没有角色名的传递。
filter的name属性里放的是角色名。这点在Spring创建ShiroFilter 可以看到。

//getFilters()拿到的是xml配置上的filters
        Map<String, Filter> filters = getFilters();
        if (!CollectionUtils.isEmpty(filters)) {
            for (Map.Entry<String, Filter> entry : filters.entrySet()) {
                String name = entry.getKey();
                Filter filter = entry.getValue();
                applyGlobalPropertiesIfNecessary(filter);
                if (filter instanceof Nameable) {
                    ((Nameable) filter).setName(name);
                }
                //'init' argument is false, since Spring-configured filters should be initialized
                //in Spring (i.e. 'init-method=blah') or implement InitializingBean:
                manager.addFilter(name, filter, false);
            }
        }

现在想要把filter的信息传给realm就需要在他们之间传递的对象动手脚了。让Token把Filter对象带过去就行了。
那那边怎么处理呢。

实例安全管理器的时候，会实例一个ModularRealmAuthorizer对象，并可以设置为我们自定义的。

 private Authorizer authorizer;
//安全管理器实现类的父类，在实例安全管理器的时候，会创建一个ModularRealmAuthorizer对象，迭代Realm验证，就是ModularRealmAuthorizer做的工作
    /**
     * Default no-arg constructor that initializes an internal default
     * {@link org.apache.shiro.authz.ModularRealmAuthorizer ModularRealmAuthorizer}.
     */
    public AuthorizingSecurityManager() {
        super();
        this.authorizer = new ModularRealmAuthorizer();
    }

   public void setAuthorizer(Authorizer authorizer) {
        if (authorizer == null) {
            String msg = "Authorizer argument cannot be null.";
            throw new IllegalArgumentException(msg);
        }
        this.authorizer = authorizer;
    }

到这里，Filter&Realm绑定需要修改的地方基本都知道了。
重写FormAuthenticationFilter的createToken(String username, String password,boolean rememberMe, String host)方法，自定义一个Token，可以存放Filter。重写ModularRealmAuthorizer对象中获取Realm的方法。

下面是实现代码

NewFormAuthenticationFilter 实现

public class NewFormAuthenticationFilter extends FormAuthenticationFilter {
    /**
     * 创建自定义的令牌，加入当前filter
     */
    @Override
    protected AuthenticationToken createToken(String username, String password,
            boolean rememberMe, String host) {
        return new UsernamePasswordAndFilterToken(username, password,
                rememberMe, host, this);
    }

    /**
     * 获取当前Filter的名字（角色名）扩大访问范围
     */
    @Override
    public String getName() {
        return super.getName();
    }

}

UsernamePasswordAndFilterToken 实现

public class UsernamePasswordAndFilterToken extends UsernamePasswordToken {

    /**
     * 
     */
    private static final long serialVersionUID = 1L;
    /**
     * 存放当前Filter
     */
    private NameableFilter loginFilter;

    public UsernamePasswordAndFilterToken() {
        super();
    }

    public UsernamePasswordAndFilterToken(final String username,
            final char[] password, final boolean rememberMe, final String host,
            final AdviceFilter loginFilter) {
        super(username, password, rememberMe, host);
        this.loginFilter = loginFilter;
    }

    public UsernamePasswordAndFilterToken(final String username,
            final String password, final boolean rememberMe, final String host,
            final AdviceFilter loginFilter) {
        super(username, password, rememberMe, host);
        this.loginFilter = loginFilter;
    }

    public NameableFilter getLoginFilter() {
        return loginFilter;
    }

    public void setLoginFilter(NameableFilter loginFilter) {
        this.loginFilter = loginFilter;
    }
}

DefineModularRealmAuthenticator 实现

public class DefineModularRealmAuthenticator extends ModularRealmAuthenticator {

    private static final Logger log = LoggerFactory
            .getLogger(DefineModularRealmAuthenticator.class);
    
    private Map<String, Realm> defineRealms;

    /**
     * 判断Realm是不是null
     */
    @Override
    protected void assertRealmsConfigured() throws IllegalStateException {
        defineRealms = getDefineRealms();
        if (CollectionUtils.isEmpty(defineRealms)) {
            String msg = "Configuration error:  No realms have been configured!  One or more realms must be "
                    + "present to execute an authentication attempt.";
            throw new IllegalStateException(msg);
        }
    }
    /**
     * 根据filter的name 取对应realm进行登录
     */
    @Override
    protected AuthenticationInfo doAuthenticate(
            AuthenticationToken authenticationToken)
            throws AuthenticationException {
        assertRealmsConfigured();
    
        /**
         * authenticationToken 如果是自定义的UsernamePasswordAndFilterToken，调用单个realm
         * 否则 使用默认的迭代realm方式
         */
        if(authenticationToken instanceof UsernamePasswordAndFilterToken){
                NewFormAuthenticationFilter loginFilter = (NewFormAuthenticationFilter)((UsernamePasswordAndFilterToken) authenticationToken).getLoginFilter();

                Realm realm = defineRealms.get(loginFilter.getName());
                if(realm==null){
                    log.error("没有配置NewFormAuthenticationFilter对应的Realm");
                    throw new RuntimeException("没有配置NewFormAuthenticationFilter对应的Realm");
                };
                return doSingleRealmAuthentication(realm,authenticationToken);
        }else {
            return oldDoAuthenticate(authenticationToken);
        }
            

    }

    private  AuthenticationInfo oldDoAuthenticate(AuthenticationToken authenticationToken)throws AuthenticationException{
        
        Collection<Realm> realms = defineRealms.values();
        if (realms.size() == 1) {
            return doSingleRealmAuthentication(realms.iterator().next(), authenticationToken);
        } else {
            return doMultiRealmAuthentication(realms, authenticationToken);
        }
    }
    
    public void setDefineRealms(Map<String, Realm> defineRealms) {
        this.defineRealms = defineRealms;
    }

    public Map<String, Realm> getDefineRealms() {
        return defineRealms;
    }
}

在xml中的配置修改为

<bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
        <!-- shiro 的核心安全接口 -->
        <property name="securityManager" ref="securityManager" />
        <!-- 未授权时要跳转的连接 -->
        <property name="unauthorizedUrl" value="/unauthorized.jsp" />
        <property name="filters">
            <map>
                <entry key="admin" value-ref="adminformAuthenticationFilter" />
                <entry key="authc" value-ref="formAuthenticationFilter" />
            </map>
        </property>
        <!-- shiro 连接约束配置 -->
        <property name="filterChainDefinitions">
            <value>
                /user.html = authc
                /admin.html =authc
                /login.html = authc
                /admin/login.html =admin
                /logout = logout
                /resource/** = anon
            </value>
        </property>
    </bean>
    <!-- filter&realm绑定 -->
    <bean id="DefineModularRealmAuthenticator"
        class="cc.yihy.shiro.authc.pam.DefineModularRealmAuthenticator">
        <property name="defineRealms">
            <map>
                <entry key="authc" value-ref="UserRealm" />
                <entry key="admin" value-ref="AdminRealm" />
            </map>
        </property>
    </bean>
    <bean id="formAuthenticationFilter"
        class="cc.yihy.shiro.filter.NewFormAuthenticationFilter">
        <property name="loginUrl" value="/login.html" />
        <property name="successUrl" value="/ok.html" />
    </bean>
    <bean id="adminformAuthenticationFilter"
        class="cc.yihy.shiro.filter.NewFormAuthenticationFilter">
        <property name="loginUrl" value="/admin/login.html" />
        <property name="successUrl" value="/admin/ok.html" />
    </bean>
    <bean id="AdminRealm" class="cc.yihy.realm.AdminRealm">
        <property name="userService" ref="UserService" />
    </bean>
    <bean id="UserRealm" class="cc.yihy.realm.UserRealm">
        <property name="userService" ref="UserService" />
    </bean>
    <!-- 安全管理器 -->
    <bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
    <!-- filter&realm绑定 -->
        <property name="authenticator" ref="DefineModularRealmAuthenticator" />
    </bean>
    <bean id="lifecycleBeanPostProcessor" class="org.apache.shiro.spring.LifecycleBeanPostProcessor" />

到此，绑定工作完成。。。

欢迎拍砖提问。
用MarkDown写博客感觉还不错。
表示差点把Shiro开始创建执行的过程写上去。

在后面进行页面上权限校验会报错，原因出在改变了realm的注入方式。解决办法，近期我会整理出来。

权限校验问题修复

权限校验会报错是因为修改了注入realm的位置，导致授权解释器拿不到realm集合，现在把授权解释器重写了，并注入realms，使其恢复正常

<!-- realms Map -->

    <bean id="defineRealms" class="org.springframework.beans.factory.config.MapFactoryBean">

        <property name="sourceMap">

            <map>

                <entry key="authc" value-ref="SSOUserRealm"/>

                <!--<entry key="NormalUser" value-ref="UserRealm"/>-->

                <!--<entry key="authUser" value-ref="UserRealm"/>-->

                <entry key="SSOUser" value-ref="SSOUserRealm"/>


                <entry key="mxUser" value-ref="AUserRealm"/>

                <entry key="normalMx" value-ref="AUserRealm"/>

                <entry key="mxAdmin" value-ref="AUserRealm"/>

                <entry key="subMxAdmin" value-ref="AUserRealm"/>


                <entry key="xhAdmin" value-ref="XhUserRealm"/>

                <entry key="xhUser" value-ref="XhUserRealm"/>

                <entry key="subXhUser" value-ref="XhUserRealm"/>

            </map>

        </property>

    </bean>

 <!-- filter&realm绑定 -->
    <!--认证解释器-->
    <bean id="DefineModularRealmAuthenticator"

          class="cc.yihy.shiro.authc.pam.DefineModularRealmAuthenticator">

        <property name="defineRealms" ref="defineRealms"/>

    </bean>


    <!--授权解释器-->
    <bean id="DefineModularRealmAuthorizer"

          class="cc.yihy.shiro.authz.DefineModularRealmAuthorizer">

        <property name="defineRealms" ref="defineRealms"/>

    </bean>

 <!-- securityManager安全管理器 -->

    <bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">


        <!-- filter&realm绑定 登录 -->

        <property name="authenticator" ref="DefineModularRealmAuthenticator"/>

        <!-- filter&realm绑定 角色权限验证 -->

        <property name="authorizer" ref="DefineModularRealmAuthorizer"/>

        <!-- 注入缓存管理器 -->

        <property name="cacheManager" ref="ShiroCacheManager"/>

        <!-- 注入session管理器 -->

        <property name="sessionManager" ref="sessionManager"/>

        <!-- 记住我 -->

        <property name="rememberMeManager" ref="rememberMeManager"/>

    </bean>