1.入口类：AbstractAuthenticator
用户输入的登录信息经过其authenticate方法：
public final AuthenticationInfo authenticate(AuthenticationToken token) throws AuthenticationException {
if (token == null) {
throw new IllegalArgumentException("Method argument (authentication token) cannot be null.");
} else {
log.trace("Authentication attempt received for token [{}]", token);
AuthenticationInfo info;
try {
info = this.doAuthenticate(token);
if (info == null) {
String msg = "No account information found for authentication token [" + token + "] by this " + "Authenticator instance. Please check that it is configured correctly.";
throw new AuthenticationException(msg);
}
} catch (Throwable var8) {
AuthenticationException ae = null;
if (var8 instanceof AuthenticationException) {
ae = (AuthenticationException)var8;
}
if (ae == null) {
String msg = "Authentication failed for token submission [" + token + "]. Possible unexpected " + "error? (Typical or expected login exceptions should extend from AuthenticationException).";
ae = new AuthenticationException(msg, var8);
if (log.isWarnEnabled()) {
log.warn(msg, var8);
}
}
try {
this.notifyFailure(token, ae);
} catch (Throwable var7) {
if (log.isWarnEnabled()) {
String msg = "Unable to send notification for failed authentication attempt - listener error?. Please check your AuthenticationListener implementation(s). Logging sending exception and propagating original AuthenticationException instead...";
log.warn(msg, var7);
}
}
throw ae;
}
log.debug("Authentication successful for token [{}]. Returned account [{}]", token, info);
this.notifySuccess(token, info);
return info;
}
}
其中的token包含用户输入的登录信息，如果是用户名/密码登录，这里是UsernamePasswordToken,其属性：username（这里测试账号是admin）、password（这里是111111）、rememberMe（记住我，前台勾选，默认false）、host
2.在上面的方法里，进入内层doAuthenticate方法（传入上面的用户登录token），这个方法是子类ModularRealmAuthenticator实现的方法（1中是模板设计模式，抽象父类声明，子类实现）：
protected AuthenticationInfo doAuthenticate(AuthenticationToken authenticationToken) throws AuthenticationException {
this.assertRealmsConfigured();
Collection<Realm> realms = this.getRealms();
return realms.size() == 1 ? this.doSingleRealmAuthentication((Realm)realms.iterator().next(), authenticationToken) : this.doMultiRealmAuthentication(realms, authenticationToken);
}
这里是根据认证类型选择单Realm还是多Realm认证，进入不同的方法。这里进入前者，即单Realm认证。
无论那种认证，这里最终返回一个AuthenticationInfo实例，为 类型
3.在上面的方法里，进入doSingleRealmAuthentication方法，传入了Realm和上面的用户登录token，其中Realm是Realm链中的一个，是我们自定义的一个Realm：
protected AuthenticationInfo doSingleRealmAuthentication(Realm realm, AuthenticationToken token) {
if (!realm.supports(token)) {
String msg = "Realm [" + realm + "] does not support authentication token [" + token + "]. Please ensure that the appropriate Realm implementation is " + "configured correctly or that the realm accepts AuthenticationTokens of this type.";
throw new UnsupportedTokenException(msg);
} else {
AuthenticationInfo info = realm.getAuthenticationInfo(token);
if (info == null) {
String msg = "Realm [" + realm + "] was unable to find account data for the " + "submitted AuthenticationToken [" + token + "].";
throw new UnknownAccountException(msg);
} else {
return info;
}
}
}
从这里开始，我们要进入自定义Realm的逻辑。这里，我们自定义的Realm完整如下：
/** * Copyright 2018-2020 stylefeng & fengshuonan (https://gitee.com/stylefeng) * <p> * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at * <p> * http://www.apache.org/licenses/LICENSE-2.0 * <p> * Unless required by applicable law or agreed to in writing, software * distributed under the License is distributed on an "AS IS" BASIS, * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * See the License for the specific language governing permissions and * limitations under the License. */ package cn.stylefeng.guns.core.shiro; import cn.stylefeng.guns.core.shiro.service.UserAuthService; import cn.stylefeng.guns.core.shiro.service.impl.UserAuthServiceServiceImpl; import cn.stylefeng.guns.modular.system.model.User; import cn.stylefeng.roses.core.util.ToolUtil; import org.apache.shiro.authc.AuthenticationException; import org.apache.shiro.authc.AuthenticationInfo; import org.apache.shiro.authc.AuthenticationToken; import org.apache.shiro.authc.UsernamePasswordToken; import org.apache.shiro.authc.credential.CredentialsMatcher; import org.apache.shiro.authc.credential.HashedCredentialsMatcher; import org.apache.shiro.authz.AuthorizationInfo; import org.apache.shiro.authz.SimpleAuthorizationInfo; import org.apache.shiro.realm.AuthorizingRealm; import org.apache.shiro.subject.PrincipalCollection; import java.util.HashSet; import java.util.List; import java.util.Set; public class ShiroDbRealm extends AuthorizingRealm { /** * 登录认证 */ @Override protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authcToken) throws AuthenticationException { UserAuthService shiroFactory = UserAuthServiceServiceImpl.me(); UsernamePasswordToken token = (UsernamePasswordToken) authcToken; User user = shiroFactory.user(token.getUsername()); ShiroUser shiroUser = shiroFactory.shiroUser(user); return shiroFactory.info(shiroUser, user, super.getName()); } /** * 权限认证 */ @Override protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) { UserAuthService shiroFactory = UserAuthServiceServiceImpl.me(); ShiroUser shiroUser = (ShiroUser) principals.getPrimaryPrincipal(); List<Integer> roleList = shiroUser.getRoleList(); Set<String> permissionSet = new HashSet<>(); Set<String> roleNameSet = new HashSet<>(); for (Integer roleId : roleList) { List<String> permissions = shiroFactory.findPermissionsByRoleId(roleId); if (permissions != null) { for (String permission : permissions) { if (ToolUtil.isNotEmpty(permission)) { permissionSet.add(permission); } } } String roleName = shiroFactory.findRoleNameByRoleId(roleId); roleNameSet.add(roleName); } SimpleAuthorizationInfo info = new SimpleAuthorizationInfo(); info.addStringPermissions(permissionSet); info.addRoles(roleNameSet); return info; } /** * 设置认证加密方式 */ @Override public void setCredentialsMatcher(CredentialsMatcher credentialsMatcher) { HashedCredentialsMatcher md5CredentialsMatcher = new HashedCredentialsMatcher(); md5CredentialsMatcher.setHashAlgorithmName(ShiroKit.hashAlgorithmName); md5CredentialsMatcher.setHashIterations(ShiroKit.hashIterations); super.setCredentialsMatcher(md5CredentialsMatcher); } }
4.在3中的方法里，继续传入token,进入我们自定义的Realm的getAuthenticationInfo方法里，这又是一个模板方法，实现在父类AuthenticatingRealm中，AuthenticatingRealm是AuthorizingRealm的父类，而我们的自定义Realm继承AuthorizingRealm：
public final AuthenticationInfo getAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
AuthenticationInfo info = this.getCachedAuthenticationInfo(token);//这是从缓存获取，这里为null
if (info == null) {
info = this.doGetAuthenticationInfo(token);
log.debug("Looked up AuthenticationInfo [{}] from doGetAuthenticationInfo", info);
if (token != null && info != null) {
this.cacheAuthenticationInfoIfPossible(token, info);//这是放入缓存
}
} else {
log.debug("Using cached authentication info [{}] to perform credentials matching.", info);
}
if (info != null) {
this.assertCredentialsMatch(token, info);
} else {
log.debug("No AuthenticationInfo found for submitted AuthenticationToken [{}]. Returning null.", token);
}
return info;
}
这里先从缓存获取认证信息，这里为null,获取不到则调用自定义Realm的doGetAuthenticationInfo方法获取认证信息（模板方法模式），传入的仍然是上面的用户登录token，这样又进入到了我们的自定义Realm方法实现中：
/** * 登录认证 */ @Override protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authcToken) throws AuthenticationException { UserAuthService shiroFactory = UserAuthServiceServiceImpl.me(); UsernamePasswordToken token = (UsernamePasswordToken) authcToken; User user = shiroFactory.user(token.getUsername()); ShiroUser shiroUser = shiroFactory.shiroUser(user); return shiroFactory.info(shiroUser, user, super.getName()); }
我们的Realm获取认证信息的方式：
a.从Spring容器获取我们自定义实现的业务类，该类注入了数据库用户操作的Mapper（继承了MyBatis-Plus的BaseMapper接口）
b.使用自定义业务类的数据库Mapper,根据用户登录token中的用户名到数据库获取数据库对应的用户信息
c.根据用户表roleId字段，关联查询用户对应角色（集合）信息
d.调用了业务类自定义的如下方法：
@Override public SimpleAuthenticationInfo info(ShiroUser shiroUser, User user, String realmName) { String credentials = user.getPassword(); // 密码加盐处理 String source = user.getSalt();//数据库存储原始盐值 ByteSource credentialsSalt = new Md5Hash(source);//转换后使用的哈希盐值 return new SimpleAuthenticationInfo(shiroUser, credentials, credentialsSalt, realmName); }
这里使用了盐值加密，获取了该用户数据库存储的原始盐值，调用Shiro框架的Md5Hash方法获取了哈希盐值。
使用数据库用户信息（Object类型，这里是自定义ShiroUser）、数据库存储的哈希后的密码、哈希盐值、realmName（自定义Realm全路径名加上一个并发登录的原子整形自增值，这里是自定义Realm直接调用的super.getName()）生成了一个Shiro框架要求的一个SimpleAuthenticationInfo对象返回
5.自定义Realm执行结束，向外回到4的后面部分继续执行，调用了下面方法：
protected void assertCredentialsMatch(AuthenticationToken token, AuthenticationInfo info) throws AuthenticationException {
CredentialsMatcher cm = this.getCredentialsMatcher();
if (cm != null) {
if (!cm.doCredentialsMatch(token, info)) {
String msg = "Submitted credentials for token [" + token + "] did not match the expected credentials.";
throw new IncorrectCredentialsException(msg);
}
} else {
throw new AuthenticationException("A CredentialsMatcher must be configured in order to verify credentials during authentication. If you do not wish for credentials to be examined, you can configure an " + AllowAllCredentialsMatcher.class.getName() + " instance.");
}
}
传入的是用户登录token和我们上面使用自定义Realm获取数据库用户信息，并进行封装的SimpleAuthenticationInfo实例（接口为AuthenticationInfo ）
注意这里获取到的CredentialsMatcher是我们上面自定义的Realm中的第三个@Override方法setCredentialsMatcher设置进去的，是可以自定义设置的，设置了哈希算法（这里为MD5）和哈希迭代次数（这里为1024），这里为HashedCredentialsMatcher实例。
6.上面方法中的if判断里，又进入下面方法：
public boolean doCredentialsMatch(AuthenticationToken token, AuthenticationInfo info) {
Object tokenHashedCredentials = this.hashProvidedCredentials(token, info);
Object accountCredentials = this.getCredentials(info);
return this.equals(tokenHashedCredentials, accountCredentials);
}
实现类是HashedCredentialsMatcher，这里面的三个方法：
hashProvidedCredentials：最终通过
new SimpleHash(hashAlgorithmName, credentials, salt, hashIterations);
获取一个SimpleHash（接口是Hash）实例。
其中参数分别为哈希算法（这里是MD5）、登录token中用户输入的原始密码（字符数组格式，这里是[1,1,1,1,1,1]）、哈希盐值、哈希迭代次数（这里设置成了1024），这几个参数都是自定义可配。这里最终获取的是用户输入密码通过哈希算法、哈希盐值生成的哈希密码信息。
getCredentials：最终获取的是用户数据库哈希密码信息。
equals：比较上述两个信息
最终返回到doCredentialsMatch，又返回到5中的assertCredentialsMatch方法。如果验证失败，返回IncorrectCredentialsException异常，提示（密码凭证不匹配）信息，否则验证成功，接着4中自定义Realm的getAuthenticationInfo方法逻辑返回从数据库获取、封装的SimpleAuthenticationInfo实例。
7.可以看到上面3以下的几步是层层深入到Realm里面的处理逻辑（有父类的有自定义子类的，也有调用的HashedCredentialsMatcher工具类等），现在开始走出Realm的逻辑，回到3的后半段，仍然是AbstractAuthenticator的实现类ModularRealmAuthenticator的doSingleRealmAuthentication方法：
protected AuthenticationInfo doSingleRealmAuthentication(Realm realm, AuthenticationToken token) {
if (!realm.supports(token)) {
String msg = "Realm [" + realm + "] does not support authentication token [" + token + "]. Please ensure that the appropriate Realm implementation is " + "configured correctly or that the realm accepts AuthenticationTokens of this type.";
throw new UnsupportedTokenException(msg);
} else {
AuthenticationInfo info = realm.getAuthenticationInfo(token);
if (info == null) {
String msg = "Realm [" + realm + "] was unable to find account data for the " + "submitted AuthenticationToken [" + token + "].";
throw new UnknownAccountException(msg);
} else {
return info;
}
}
}
返回自定义Realm返回的SimpleAuthenticationInfo实例，继而到外面的doAuthenticate方法：
protected AuthenticationInfo doAuthenticate(AuthenticationToken authenticationToken) throws AuthenticationException {
this.assertRealmsConfigured();
Collection<Realm> realms = this.getRealms();
return realms.size() == 1 ? this.doSingleRealmAuthentication((Realm)realms.iterator().next(), authenticationToken) : this.doMultiRealmAuthentication(realms, authenticationToken);
}
继续返回自定义Realm返回的SimpleAuthenticationInfo实例，最终回到抽象类AbstractAuthenticator的authenticate方法，即我们开头的方法。
最终返回的就是自定义Realm返回的AuthenticationInfo的实现类SimpleAuthenticationInfo的实例，实例包括用户自定义ShiroUser信息（principals，可有多个自定义用户信息实体）、哈希密码（credentials）、哈希盐值（credentialsSalt）信息。
8.最终返回到的是外层的类AuthenticatingSecurityManager，继承了RealmSecurityManager，最终实现的是SecurityManager.这里是调用了AuthenticatingSecurityManager的下面方法：
public AuthenticationInfo authenticate(AuthenticationToken token) throws AuthenticationException {
return this.authenticator.authenticate(token);
}
返回的就是上面几步获取认证的AuthenticationInfo。这个方法又是模板方法，继而向更外层返回到子类DefaultSecurityManager的login方法：
public Subject login(Subject subject, AuthenticationToken token) throws AuthenticationException {
AuthenticationInfo info;
try {
info = this.authenticate(token);
} catch (AuthenticationException var7) {
AuthenticationException ae = var7;
try {
this.onFailedLogin(token, ae, subject);
} catch (Exception var6) {
if (log.isInfoEnabled()) {
log.info("onFailedLogin method threw an exception. Logging and propagating original AuthenticationException.", var6);
}
}
throw var7;
}
Subject loggedIn = this.createSubject(token, info, subject);
this.onSuccessfulLogin(token, info, loggedIn);
return loggedIn;
}
这里传入的参数Subject里面有request信息，token仍然是用户输入登录信息（这里是用户名、密码），上面的所有过程并没有Subject参与，而是token.最终登录成功后，是使用token,登录成功返回的AuthenticationInfo，和上面这个包含request信息的Subject,封装了另外一个Subject：
protected Subject createSubject(AuthenticationToken token, AuthenticationInfo info, Subject existing) {
SubjectContext context = this.createSubjectContext();
context.setAuthenticated(true);
context.setAuthenticationToken(token);
context.setAuthenticationInfo(info);
if (existing != null) {
context.setSubject(existing);
}
return this.createSubject(context);
}
这个方法使用SubjectContext封装认证成功信息，再把带request的Subject设置其中，最后使用这个context调用下面方法：
public Subject createSubject(SubjectContext subjectContext) {
SubjectContext context = this.copy(subjectContext);
context = this.ensureSecurityManager(context);
context = this.resolveSession(context);
context = this.resolvePrincipals(context);
Subject subject = this.doCreateSubject(context);
this.save(subject);
return subject;
}
这里的前三个方法最终都是获取DefaultSubjectContext（它是的SubjectContext子类）对应的SecurityManager,Session,Principals组件进行确认
最后的doCreateSubject方法最终调用到类DefaultWebSubjectFactory（父类是DefaultSubjectFactory，实现了SubjectFactory接口）的下面方法：
public Subject createSubject(SubjectContext context) {
if (!(context instanceof WebSubjectContext)) {
return super.createSubject(context);
} else {
WebSubjectContext wsc = (WebSubjectContext)context;
SecurityManager securityManager = wsc.resolveSecurityManager();
Session session = wsc.resolveSession();
boolean sessionEnabled = wsc.isSessionCreationEnabled();
PrincipalCollection principals = wsc.resolvePrincipals();
boolean authenticated = wsc.resolveAuthenticated();
String host = wsc.resolveHost();
ServletRequest request = wsc.resolveServletRequest();
ServletResponse response = wsc.resolveServletResponse();
return new WebDelegatingSubject(principals, authenticated, host, session, sessionEnabled, request, response, securityManager);
}
}
这里充分说明我们封装的SubjectContext是Web环境上下文，包含了request信息和认证成功后的信息、Session等信息。这里重新拿到这些信息，最终用这些信息生成了一个WebDelegatingSubject实例进行返回，它是一个代理类，最终实现了Subject接口。
回到上面的doCreateSubject方法，进而回到createSubject方法，返回的就是这个WebDelegatingSubject实例：
public Subject createSubject(SubjectContext subjectContext) {
SubjectContext context = this.copy(subjectContext);
context = this.ensureSecurityManager(context);
context = this.resolveSession(context);
context = this.resolvePrincipals(context);
Subject subject = this.doCreateSubject(context);
this.save(subject);
return subject;
}
继续走save方法，这里将包含已认证用户信息的Subject放入Session中。
向外继续回到
createSubject(AuthenticationToken token, AuthenticationInfo info, Subject existing)
方法，返回的是这个WebDelegatingSubject实例。
向外继续返回到DefaultSecurityManager的login方法剩余部分：
Subject loggedIn = this.createSubject(token, info, subject);
this.onSuccessfulLogin(token, info, loggedIn);
return loggedIn;
onSuccessfulLogin方法是处理rememberMe相关信息。
最终返回到：
9.DelegatingSubject（实现了Subject接口）的login方法：
public void login(AuthenticationToken token) throws AuthenticationException {
this.clearRunAsIdentitiesInternal();
Subject subject = this.securityManager.login(this, token);
String host = null;
PrincipalCollection principals;
if (subject instanceof DelegatingSubject) {
DelegatingSubject delegating = (DelegatingSubject)subject;
principals = delegating.principals;
host = delegating.host;
} else {
principals = subject.getPrincipals();
}
if (principals != null && !principals.isEmpty()) {
this.principals = principals;
this.authenticated = true;
if (token instanceof HostAuthenticationToken) {
host = ((HostAuthenticationToken)token).getHost();
}
if (host != null) {
this.host = host;
}
Session session = subject.getSession(false);
if (session != null) {
this.session = this.decorate(session);
} else {
this.session = null;
}
} else {
String msg = "Principals returned from securityManager.login( token ) returned a null or empty value. This value must be non null and populated with one or more elements.";
throw new IllegalStateException(msg);
}
}
看来SecurityManager的login方法是这里调用的，返回了认证成功的WebDelegatingSubject实例后，这里继续向下执行就是DelegatingSubject实例的一些简单的赋值逻辑了，也就是把上面返回的认证成功的WebDelegatingSubject实例信息给到这个DelegatingSubject。
10.之后这个DelegatingSubject实例返回给我们自定义的@Controller类。原来我们是在自定义的@Controller类中调用了Shiro的
SecurityUtils.getSubject();
来获取的9中DelegatingSubject的Web实例WebDelegatingSubject，执行了上面的login操作。
此后我们自定义的@Controller类的逻辑就是使用返回的WebDelegatingSubject中的用户认证信息设置Session,最终重定向到主页。
登录Controller完整的登录方法如下：
/** * 点击登录执行的动作 */ @RequestMapping(value = "/login", method = RequestMethod.POST) public String loginVali() { String username = super.getPara("username").trim(); String password = super.getPara("password").trim(); String remember = super.getPara("remember"); //验证验证码是否正确 if (KaptchaUtil.getKaptchaOnOff()) { String kaptcha = super.getPara("kaptcha").trim(); String code = (String) super.getSession().getAttribute(Constants.KAPTCHA_SESSION_KEY); if (ToolUtil.isEmpty(kaptcha) || !kaptcha.equalsIgnoreCase(code)) { throw new InvalidKaptchaException(); } } Subject currentUser = ShiroKit.getSubject(); UsernamePasswordToken token = new UsernamePasswordToken(username, password.toCharArray()); if ("on".equals(remember)) { token.setRememberMe(true); } else { token.setRememberMe(false); } currentUser.login(token); ShiroUser shiroUser = ShiroKit.getUser(); super.getSession().setAttribute("shiroUser", shiroUser); super.getSession().setAttribute("username", shiroUser.getAccount()); LogManager.me().executeLog(LogTaskFactory.loginLog(shiroUser.getId(), getIp())); ShiroKit.getSession().setAttribute("sessionFlag", true); return REDIRECT + "/"; }
可以看到我们自己使用用户传入的登录信息封装了UsernamePasswordToken，并使用它来进行了Shiro的登录流程。
进一步研究提示：
1.SecurityUtils.getSubject()原理（和配置的Shiro怎样整合、获取Web环境及request有关）。
2.Session配置和获取相关，分布式Session问题。
3.rememberMe原理和配置。
补充：Shiro集成到Web（Tomcat、SpringMVC、Spring、Spring Boot）
1.请求不同的Servlet,其过滤器链可能不同（每个过滤器配置了过滤规则），所以每次Web容器使用createFilterChain方法为每个Servlet调用创建FilterChain（Java原生，这里实例为ApplicationFilterChain），包含该Servlet每个配置的Filter（Java原生），形成责任链调用（这里集成SpringMVC,所以Servlet类型为DispatcherServlet，即SpringMVC的前端控制器），即从一个FilterMap里匹配出一个和当前请求url对应的Filter集合加入到创建的FilterChain当中
2.执行ApplicationFilterChain的doFilter方法，里面是对每个Filter的链式调用：迭代每个Filter,执行其doFilter方法，这个方法的内部逻辑是：还没执行的就执行其内部的doFilterInterval方法，在这个方法里使用FilterChain的doFilter返回FilterChain；执行完的直接执行FilterChain的doFilter返回FilterChain。这样不断回到FilterChain继续迭代Filter（Filter数组游标++并判断是否到头），直到执行完最后一个Filter，其调用的FilterChain的doFilter方法进入else，结束，返回到这个Filter,再返回到调用它的FilterChain的doFilter方法，再返回到上一个Filter...这样反向层层返回到Filter和FilterChain的doFilter方法，直到整个责任链在最外层的ApplicationFilterChain的doFilter方法返回
3.其中责任链走到SpringMVC的DelegatingFilterProxy时，这个代理Filter代理了一个名为delegatingFilterProxy的类，这就是在Spring中配置的Shiro的Filter,这里在DelegatingFilterProxy的下面方法中：
protected void invokeDelegate(Filter delegate, ServletRequest request, ServletResponse response, FilterChain filterChain) throws ServletException, IOException {
delegate.doFilter(request, response, filterChain);
}
走到Shiro的AbstractShiroFilter，在其doFilterInternal方法里，执行：
protected void doFilterInternal(ServletRequest servletRequest, ServletResponse servletResponse, final FilterChain chain) throws ServletException, IOException {
Throwable t = null;
try {
final ServletRequest request = this.prepareServletRequest(servletRequest, servletResponse, chain);
final ServletResponse response = this.prepareServletResponse(request, servletResponse, chain);
Subject subject = this.createSubject(request, response);
subject.execute(new Callable() {
public Object call() throws Exception {
AbstractShiroFilter.this.updateSessionLastAccessTime(request, response);
AbstractShiroFilter.this.executeChain(request, response, chain);
return null;
}
});
} catch (ExecutionException var8) {
t = var8.getCause();
} catch (Throwable var9) {
t = var9;
}
if (t != null) {
if (t instanceof ServletException) {
throw (ServletException)t;
} else if (t instanceof IOException) {
throw (IOException)t;
} else {
String msg = "Filtered request failed.";
throw new ServletException(msg, t);
}
}
}
这里的request类型变换为ShiroHttpServletRequest，调用的createSubject方法如下：
protected WebSubject createSubject(ServletRequest request, ServletResponse response) {
return (new Builder(this.getSecurityManager(), request, response)).buildWebSubject();
}
这里获取到配置的SecurityManager配置了一个WebDelegatingSubject返回，这个类原理流程可以参照上文的源码分析
4.接着executeChain方法内开始走Shiro内部配置的Filter（实际是又创建了一个ProxiedFilterChain进行内部转发，最后回到Web容器创建的ApplicationFilterChain），这里走我们配置的自定义的OAuth2Filter，该类继承了AuthenticatingFilter，下面是走该类的一系列父类：
AdviceFilter的doFilterInternal方法，它是PathMatchingFilter的父类，在这个方法里接着走PathMatchingFilter的preHandle方法（模板方法模式），进行迭代路径匹配，这个路径是我们在Shiro中自定义配置的拦截路径，比如配置为"anon"的路径不需要认证就可访问，其他均需走oauth2，也就是下面我们以此名字配置的子类OAuth2Filter，配置如下：
@Bean("shiroFilter")//2.用来初始化DelegatingFilterProxy来向Web容器注册Shiro的Filter,拦截所有请求
public ShiroFilterFactoryBean shirFilter(SecurityManager securityManager) {
ShiroFilterFactoryBean shiroFilter = new ShiroFilterFactoryBean();
shiroFilter.setSecurityManager(securityManager);//设置了SecurityManager
//oauth过滤
Map<String, Filter> filters = new HashMap<>();
filters.put("oauth2", new OAuth2Filter());//3.Shiro级过滤器，拦截带token的请求，获取请求token，封装到OAuth2Token（实现了AuthenticationToken），继续传递给Realm处理接口
shiroFilter.setFilters(filters);
Map<String, String> filterMap = new LinkedHashMap<>();
filterMap.put("/webjars/**", "anon");
filterMap.put("/druid/**", "anon");
filterMap.put("/app/**", "anon");
filterMap.put("/sys/login", "anon");
filterMap.put("/swagger/**", "anon");
filterMap.put("/v2/api-docs", "anon");
filterMap.put("/swagger-ui.html", "anon");
filterMap.put("/swagger-resources/**", "anon");
filterMap.put("/captcha.jpg", "anon");//以上匿名访问
filterMap.put("/**", "oauth2");//4.所有其他，转到oauth2认证，名字和上面配置的oauth2的filter名字匹配
shiroFilter.setFilterChainDefinitionMap(filterMap);
return shiroFilter;
}
这里如果不是anon管理的路径，则在preHandle方法里面，继续走我们的OAuth2Filter的父类：走AccessControlFilter的onPreHandle方法，它继承了PathMatchingFilter：
public boolean onPreHandle(ServletRequest request, ServletResponse response, Object mappedValue) throws Exception {
return this.isAccessAllowed(request, response, mappedValue) || this.onAccessDenied(request, response, mappedValue);
}
这个方法里走的两个方法，则是我们OAuth2Filter中覆盖的两个方法，执行前一个返回true则不再执行后一个，否则执行后一个，我们定义的OAuth2Filter完整如下：
package io.renren.modules.sys.oauth2; import com.google.gson.Gson; import io.renren.common.utils.HttpContextUtils; import io.renren.common.utils.R; import org.apache.commons.lang.StringUtils; import org.apache.http.HttpStatus; import org.apache.shiro.authc.AuthenticationException; import org.apache.shiro.authc.AuthenticationToken; import org.apache.shiro.web.filter.authc.AuthenticatingFilter; import org.springframework.web.bind.annotation.RequestMethod; import javax.servlet.ServletRequest; import javax.servlet.ServletResponse; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; import java.io.IOException; /** * oauth2过滤器 * * @author chenshun * @email sunlightcs@gmail.com * @date 2017-05-20 13:00 */ public class OAuth2Filter extends AuthenticatingFilter { @Override protected AuthenticationToken createToken(ServletRequest request, ServletResponse response) throws Exception { //获取请求token String token = getRequestToken((HttpServletRequest) request); if(StringUtils.isBlank(token)){ return null; } return new OAuth2Token(token); } @Override protected boolean isAccessAllowed(ServletRequest request, ServletResponse response, Object mappedValue) { if(((HttpServletRequest) request).getMethod().equals(RequestMethod.OPTIONS.name())){ return true; } return false; } @Override protected boolean onAccessDenied(ServletRequest request, ServletResponse response) throws Exception { //获取请求token，如果token不存在，直接返回401 String token = getRequestToken((HttpServletRequest) request); if(StringUtils.isBlank(token)){ HttpServletResponse httpResponse = (HttpServletResponse) response; httpResponse.setHeader("Access-Control-Allow-Credentials", "true"); httpResponse.setHeader("Access-Control-Allow-Origin", HttpContextUtils.getOrigin()); String json = new Gson().toJson(R.error(HttpStatus.SC_UNAUTHORIZED, "invalid token")); httpResponse.getWriter().print(json); return false; } return executeLogin(request, response); } @Override protected boolean onLoginFailure(AuthenticationToken token, AuthenticationException e, ServletRequest request, ServletResponse response) { HttpServletResponse httpResponse = (HttpServletResponse) response; httpResponse.setContentType("application/json;charset=utf-8"); httpResponse.setHeader("Access-Control-Allow-Credentials", "true"); httpResponse.setHeader("Access-Control-Allow-Origin", HttpContextUtils.getOrigin()); try { //处理登录失败的异常 Throwable throwable = e.getCause() == null ? e : e.getCause(); R r = R.error(HttpStatus.SC_UNAUTHORIZED, throwable.getMessage()); String json = new Gson().toJson(r); httpResponse.getWriter().print(json); } catch (IOException e1) { } return false; } /** * 获取请求的token */ private String getRequestToken(HttpServletRequest httpRequest){ //从header中获取token String token = httpRequest.getHeader("token"); //如果header中不存在token，则从参数中获取token if(StringUtils.isBlank(token)){ token = httpRequest.getParameter("token"); } return token; } }
这里如果没登录过，都是走后一个方法，即onAccessDenied方法，这里是走我们自定义的onAccessDenied方法，该方法最后调用了executeLogin方法，表明任何未认证请求都被导向登录逻辑，该方法是父类AuthenticatingFilter的方法：
protected boolean executeLogin(ServletRequest request, ServletResponse response) throws Exception {
AuthenticationToken token = this.createToken(request, response);
if (token == null) {
String msg = "createToken method implementation returned null. A valid non-null AuthenticationToken must be created in order to execute a login attempt.";
throw new IllegalStateException(msg);
} else {
try {
Subject subject = this.getSubject(request, response);
subject.login(token);
return this.onLoginSuccess(token, subject, request, response);
} catch (AuthenticationException var5) {
return this.onLoginFailure(token, var5, request, response);
}
}
}
这个方法里走的就是Shiro的登录逻辑，使用的是我们自定义的Shiro配置，其中Realm这里走的是我们自定义的OAuth2Realm，这个逻辑最上面已经分析过。
这样最后走出executeLogin方法，再走出我们的onAccessDenied方法，这个方法是上面AccessControlFilter的onPreHandle方法调用的。
5.这样4中顺着onPreHandle的返回层层向上返回，最后又返回到3中，随着executeChain方法的返回，返回到Shiro的AbstractShiroFilter的doFilterInternal方法后半段，最后按这个Filter前面的Filter责任链层层向外返回，逻辑结束。
待查：重定向跳转问题，Session问题，认证成功的token有效期配置和有效期内免登录逻辑原理。