shiro-登录验证

shiro实现登录验证，可以用它自身的方法来实现，也可以自定义方法来实现登录验证，了解了shiro的登录逻辑，实现自定义的验证逻辑就很简单

1、用shiro方法实现

shiro配置：

<bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean" >
        <property name="securityManager" ref="securityManager" />
        <property name="loginUrl" value = "/login" />
        <property name="successUrl" value = "/"  />
        <property name="unauthorizedUrl" value = "/unauthorize"/>
<property name="filterChainDefinitions">
            <value>
                /static/**=anon
                /login=authc
                /logout=logout
                /unauthorize=authc
                /**=user,perms
            </value>
        </property>
</bean>

由于shiro默认注册了FormAuthenticationFilter，所以配置中可以不需要为此方法定义bean，但有个前提，登录页面中的登录账号和密码，记住我的name必须和FormAuthenticationFilter默认的名称一致，如下图

如果登录页面的name和FormAuthenticationFilter不一致，则需要自己为FormAuthenticationFilter进行配置

<bean id="formAuthenticationFilter" class="org.apache.shiro.web.filter.authc.FormAuthenticationFilter">
        <property name="usernameParam" value="name"/>
        <property name="passwordParam" value="password1"/>
        <property name="rememberMeParam" value="rememberMe1"/>
        <property name="loginUrl" value="/login"/>
        <property name="successUrl" value="/"/>
</bean>
<bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean" >
        <property name="securityManager" ref="securityManager" />
        <property name="loginUrl" value = "/login" />
        <property name="successUrl" value = "/"  />
        <property name="unauthorizedUrl" value = "/unauthorize"/>
<property name="filters">
            <map>
                <entry key="authc" value-ref="formAuthenticationFilter"/>
            </map>
        </property>
<property name="filterChainDefinitions">
            <value>
                /static/**=anon
                /login=authc
                /logout=logout
                /unauthorize=authc
                /**=user,perms <
            </value>
        </property>
</bean>

登录页面提交后，跳转到 /login，进入登录方法，由于此路径权限设置为authc，shiro对该路径进行过滤，authc权限由FormAuthenticationFilter进行过滤。登录请求进入onAccessDenied方法

protected boolean onAccessDenied(ServletRequest request, ServletResponse response) throws Exception {
        if (isLoginRequest(request, response)) {  //判断是否是登录请求
            if (isLoginSubmission(request, response)) { // 是否是http post请求
                if (log.isTraceEnabled()) {
                    log.trace("Login submission detected.  Attempting to execute login.");
                }
                return executeLogin(request, response);
            } else {
                if (log.isTraceEnabled()) {
                    log.trace("Login page view.");
                }
                //allow them to see the login page ;)
                return true;
            }
        } else {
            if (log.isTraceEnabled()) {
                log.trace("Attempting to access a path which requires authentication.  Forwarding to the " +
                        "Authentication url [" + getLoginUrl() + "]");
            }
            saveRequestAndRedirectToLogin(request, response);
            return false;
        }
}

其中 executeLogin(request, response)方法的具体实现在继承的AuthenticatingFilter里

protected boolean executeLogin(ServletRequest request, ServletResponse response) throws Exception {
        AuthenticationToken token = createToken(request, response); 
        if (token == null) {
            String msg = "createToken method implementation returned null. A valid non-null AuthenticationToken " +"must be created in order to execute a login attempt.";
            throw new IllegalStateException(msg);
        }
        try {
            Subject subject = getSubject(request, response);
            subject.login(token);
            return onLoginSuccess(token, subject, request, response);
        } catch (AuthenticationException e) {
            return onLoginFailure(token, e, request, response);
        }
}

剖析：createToken(request, response); 具体实现在子类FormAuthenticationFilter中

protected AuthenticationToken createToken(ServletRequest request, ServletResponse response) {
    String username = getUsername(request);
    String password = getPassword(request);
    return createToken(username, password, request, response);
}

从上可以看出，具体的登录账号和密码从request中取出来，并创建了token对象，调用subject的login方法，login方法实现大致流程是用token去realm中取AuthenticationInfo对象，AuthenticationInfo对象存放的是正确的登录账号和密码，并和token中数据进行匹配，然后根据匹配情况返回相应的结果。realm中方法需自己实现，大致流程：从token中取出用户登录填写的账号，去查找正确的登录信息，若是查找不到，返回null，如果查找到对应的登录账号和密码，则封装到AuthenticationInfo对象中，并返回该对象。

java代码：

@RequestMapping(value = "/login")
public String toLogin(HttpServletRequest request, Model model){
        String exceptionClassName = (String)request.getAttribute("shiroLoginFailure");
        String error = null;
        if(UnknownAccountException.class.getName().equals(exceptionClassName)) {
            error = "用户名/密码错误";
        } else if(IncorrectCredentialsException.class.getName().equals(exceptionClassName)) {
            error = "用户名/密码错误";
        } else if(exceptionClassName != null) {
            error = "其他错误：" + exceptionClassName;
        }
        model.addAttribute("error", error);
        return "login";  // 跳转到登录页面
}

2、自定义登录实现

最关键的是在shiro配置中，登录提交的url需设置为不过滤处理，如提交到/login，则/login=anon，

方法中可实现自己的登录验证逻辑。若是账号密码匹配工作仍要shiro来完成，则将用户填写的账号和密码封装到token对象中，调用subject的login方法。

代码示例：

UsernamePasswordToken token = new UsernamePasswordToken(userName, password);
       try {
            subject.login(token);
        } catch (UnknownAccountException ua){
            returnInfo.setMessage("用户名错误");
        } catch (IncorrectCredentialsException ic){
            returnInfo.setMessage("密码错误");
        }
   }

附：

1）shiro默认注册的filters

public enum DefaultFilter {
    anon(AnonymousFilter.class),
    authc(FormAuthenticationFilter.class),
    authcBasic(BasicHttpAuthenticationFilter.class),
    logout(LogoutFilter.class),
    noSessionCreation(NoSessionCreationFilter.class),
    perms(PermissionsAuthorizationFilter.class),
    port(PortFilter.class),
    rest(HttpMethodPermissionFilter.class),
    roles(RolesAuthorizationFilter.class),
    ssl(SslFilter.class),
    user(UserFilter.class);
}

2）登录异常

UnknownAccountException（账号不存在）
IncorrectCredentialsException（密码错误）
DisabledAccountException（帐号被禁用）
LockedAccountException（帐号被锁定）
ExcessiveAttemptsException（登录失败次数过多）
ExpiredCredentialsException（凭证过期）等