项目启动时shiro加载过程

1.web下的shiro启动入口（shiro1.2及之后版本）

web入口web.xml配置

<!--- shiro 1.2 -->
    <listener>
        <listener-class>org.apache.shiro.web.env.EnvironmentLoaderListener</listener-class>
    </listener>
    <context-param>
        <param-name>shiroEnvironmentClass</param-name>
        <param-value>org.apache.shiro.web.env.IniWebEnvironment</param-value><!-- 默认先从/WEB-INF/shiro.ini，如果没有找classpath:shiro.ini -->
    </context-param>
    <context-param>
        <param-name>shiroConfigLocations</param-name>
        <param-value>classpath:shiro.ini</param-value>
    </context-param>
    <filter>
        <filter-name>shiroFilter</filter-name>
        <filter-class>org.apache.shiro.web.servlet.ShiroFilter</filter-class>
    </filter>
    <filter-mapping>
        <filter-name>shiroFilter</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>

EnvironmentLoaderListener是一个ServletContextListener，会在容器启动和销毁的时候执行对应方法。实际上具体的方法在父类EnvironmentLoader中实现

public class EnvironmentLoaderListener extends EnvironmentLoader implements ServletContextListener {

   //servlet容器启动的时候调用
    public void contextInitialized(ServletContextEvent sce) {
        initEnvironment(sce.getServletContext());
    }

    //servlet容器销毁的时候调用
    public void contextDestroyed(ServletContextEvent sce) {
        destroyEnvironment(sce.getServletContext());
    }
}

下面详细看一下EnvironmentLoader中启动初始化方法initEnvironment（源码EnvironmentLoader类119行）

    public WebEnvironment initEnvironment(ServletContext servletContext) throws IllegalStateException {

        //防止已经被初始化过了，这里做个校验
        if (servletContext.getAttribute(ENVIRONMENT_ATTRIBUTE_KEY) != null) {
            String msg = "There is already a Shiro environment associated with the current ServletContext.  " +
                    "Check if you have multiple EnvironmentLoader* definitions in your web.xml!";
            throw new IllegalStateException(msg);
        }

        servletContext.log("Initializing Shiro environment");
        log.info("Starting Shiro environment initialization.");

        long startTime = System.currentTimeMillis();

        try {
　　　　　　　//重点是这，创建WebEnvironment
            WebEnvironment environment = createEnvironment(servletContext);
            servletContext.setAttribute(ENVIRONMENT_ATTRIBUTE_KEY, environment);

            log.debug("Published WebEnvironment as ServletContext attribute with name [{}]",
                    ENVIRONMENT_ATTRIBUTE_KEY);

            if (log.isInfoEnabled()) {
                long elapsed = System.currentTimeMillis() - startTime;
                log.info("Shiro environment initialized in {} ms.", elapsed);
            }

            return environment;
        } catch (RuntimeException ex) {
            log.error("Shiro environment initialization failed", ex);
            servletContext.setAttribute(ENVIRONMENT_ATTRIBUTE_KEY, ex);
            throw ex;
        } catch (Error err) {
            log.error("Shiro environment initialization failed", err);
            servletContext.setAttribute(ENVIRONMENT_ATTRIBUTE_KEY, err);
            throw err;
        }
    }

下面看一下创建WebEnvironment过程（源码EnvironmentLoader类，193行）

    protected WebEnvironment createEnvironment(ServletContext sc) {
        
        //加载IniWebEnvironment
        Class<?> clazz = determineWebEnvironmentClass(sc);
        if (!MutableWebEnvironment.class.isAssignableFrom(clazz)) {
            throw new ConfigurationException("Custom WebEnvironment class [" + clazz.getName() +
                    "] is not of required type [" + WebEnvironment.class.getName() + "]");
        }

        //获取shiro配置路径
        String configLocations = sc.getInitParameter(CONFIG_LOCATIONS_PARAM);
        boolean configSpecified = StringUtils.hasText(configLocations);

        if (configSpecified && !(ResourceConfigurable.class.isAssignableFrom(clazz))) {
            String msg = "WebEnvironment class [" + clazz.getName() + "] does not implement the " +
                    ResourceConfigurable.class.getName() + "interface.  This is required to accept any " +
                    "configured " + CONFIG_LOCATIONS_PARAM + "value(s).";
            throw new ConfigurationException(msg);
        }

        MutableWebEnvironment environment = (MutableWebEnvironment) ClassUtils.newInstance(clazz);

        environment.setServletContext(sc);

        if (configSpecified && (environment instanceof ResourceConfigurable)) {
            ((ResourceConfigurable) environment).setConfigLocations(configLocations);
        }

        customizeEnvironment(environment);

        //重点是初始化过程
        LifecycleUtils.init(environment);

        return environment;
    }

上面代码加载IniWebEnvironment的就是web.xml中shiroEnvironmentClass配置的org.apache.shiro.web.env.IniWebEnvironment，加载过程如下（源码EnvironmentLoader类，165行），ENVIRONMENT_CLASS_PARAM=shiroEnvironmentClass，CONFIG_LOCATIONS_PARAM=shiroConfigLocations（就是web.xml配置的两个全局参数）

    protected Class<?> determineWebEnvironmentClass(ServletContext servletContext) {
        String className = servletContext.getInitParameter(ENVIRONMENT_CLASS_PARAM);
        if (className != null) {
            try {
                return ClassUtils.forName(className);
            } catch (UnknownClassException ex) {
                throw new ConfigurationException(
                        "Failed to load custom WebEnvironment class [" + className + "]", ex);
            }
        } else {
            return IniWebEnvironment.class;
        }
    }

下面分析初始化过程LifecycleUtils.init(environment)，最终会调用IniWebEnvironment的init（）方法（源代码IniWebEnvironment类，62行）

    public void init() {
        //这里暂时还没有配置文件，需要从前面加载的configLocations路径中加载
        Ini ini = getIni();

        String[] configLocations = getConfigLocations();

        if (log.isWarnEnabled() && !CollectionUtils.isEmpty(ini) &&
                configLocations != null && configLocations.length > 0) {
            log.warn("Explicit INI instance has been provided, but configuration locations have also been " +
                    "specified.  The {} implementation does not currently support multiple Ini config, but this may " +
                    "be supported in the future. Only the INI instance will be used for configuration.",
                    IniWebEnvironment.class.getName());
        }

        if (CollectionUtils.isEmpty(ini)) {
            log.debug("Checking any specified config locations.");
            //从配置路径下加载shiro配置
            ini = getSpecifiedIni(configLocations);
        }

        if (CollectionUtils.isEmpty(ini)) {
            log.debug("No INI instance or config locations specified.  Trying default config locations.");
            ini = getDefaultIni();
        }

        if (CollectionUtils.isEmpty(ini)) {
            String msg = "Shiro INI configuration was either not found or discovered to be empty/unconfigured.";
            throw new ConfigurationException(msg);
        }

        setIni(ini);

        //重点又来了，shiro需要的类是从这里开始加载的
        configure();
    }

下面分析configure（）方法，（源代码IniWebEnvironment类，95行）

    protected void configure() {

        this.objects.clear();
        //1创建securityManager，这里创建的是DefaultWebSecurityManager实例
        WebSecurityManager securityManager = createWebSecurityManager();
        setWebSecurityManager(securityManager);

        //2从配置里（这里是.ini配置文件）生成拦截器链
        FilterChainResolver resolver = createFilterChainResolver();
        if (resolver != null) {
            setFilterChainResolver(resolver);
        }
    }

构造securityManager过程和生成url拦截器链列表都很简单，这里就不展开了，感兴趣的同学可以自己debug一下。源码debug入口参考开涛大神跟我学shiro第七章实例。

简单的总结一下原生的java web项目启动时配置shiro的过程：

（1）通过EnvironmentLoaderListener监听sevlet容器启动，触发shiro初始化操作。初始化动作实际上交给其父类EnvironmentLoader实现。

（2）EnvironmentLoader主要动作是创建WebEnvironment的实现类IniWebEnvironment。

（3）IniWebEnvironment该类的作用是加载shiro初始化配置文件，然后配置SecurityManager和FilterChainResolver

（4）启动完成后，配置shiroFilter，所有路径的请求都会走该拦截器。

补充一下shiroFilter初始化

public class ShiroFilter extends AbstractShiroFilter {

    /**
     * Configures this instance based on the existing {@link org.apache.shiro.web.env.WebEnvironment} instance
     * available to the currently accessible {@link #getServletContext() servletContext}.
     *
     * @see org.apache.shiro.web.env.EnvironmentLoaderListener
     * @since 1.2
     */
    @Override
    public void init() throws Exception {
        //（1）获取webEnvironment实例
        WebEnvironment env = WebUtils.getRequiredWebEnvironment(getServletContext());
        //（2）绑定securityManager
        setSecurityManager(env.getWebSecurityManager());
        //（3）绑定filterChainResolver
        FilterChainResolver resolver = env.getFilterChainResolver();
        if (resolver != null) {
            setFilterChainResolver(resolver);
        }
    }
}

shiroFilter拦截器的实现主要在父类AbstractShiroFilter中实现，关于shiro拦截器的实现计划另有篇幅讨论，这里不深入研究，主要看一下初始化过程。

shiroFilter初始化第一步是获取WebEnvironment实例，也就是我们前面分析的IniWebEnvironment实例，该实例有两个属性SecurityManager和FilterChainResolver，shiroFilter给自己set。

然而现在项目基本不会这么使用了，了解基础的使用是为了更好的掌握shiro原理，这样结合框加就不会知其然不知其所以然，下面我们一起分析spring boot下的shiro启动入口。

2.spring boot下的shiro启动入口

maven 依赖

        <dependency>
            <groupId>org.apache.shiro</groupId>
            <artifactId>shiro-spring</artifactId>
        </dependency>

 本次实例使用java方式配置shiro，完整的配置代码如下。cacheManager和sessionDao可自行实现，例如基于redis

@Configuration
public class ShiroConfig {

    @Value("${shiro.session.expire.time}")
    private int globalSessionTimeOut;

    @Value("${shiro.cache.key}")
    private String shiroCacheKey;

    @Value("${shiro.login.url}")
    private String shiroLoginUrl;

    @Value("${shiro.auth.switch}")
    private boolean authSwitch;


    @Bean(name = "shiroFilter")
    public ShiroFilterFactoryBean shiroFilter(SecurityManager securityManager) {

        ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();
        shiroFilterFactoryBean.setSecurityManager(securityManager);

        // 没有登陆的用户只能访问登陆页面
        shiroFilterFactoryBean.setLoginUrl(shiroLoginUrl);


        //配置URL权限控制
        Map<String, String> filterChainDefinitionMap = new LinkedHashMap<>();

        if (authSwitch) {
            filterChainDefinitionMap.put(API_BASE + "/auth/login", "anon");
            filterChainDefinitionMap.put(API_BASE + "/auth/logout", "anon");
            filterChainDefinitionMap.put(API_BASE + "/auth/noauth", "anon");
            filterChainDefinitionMap.put(API_BASE + "/auth/check", "anon");
            filterChainDefinitionMap.put(API_BASE + "/auth/kickout", "anon");
            filterChainDefinitionMap.put(API_ANON_BASE + "/**", "anon");
            filterChainDefinitionMap.put("/**", "authc");
        }
        shiroFilterFactoryBean.setFilterChainDefinitionMap(filterChainDefinitionMap);

        return shiroFilterFactoryBean;
    }

    @Bean
    public FilterRegistrationBean filterRegistrationBean() {
        FilterRegistrationBean filterRegistration = new FilterRegistrationBean();
        filterRegistration.setFilter(new DelegatingFilterProxy("shiroFilter"));
        filterRegistration.addInitParameter("targetFilterLifecycle", "true");
        filterRegistration.setEnabled(true);
        filterRegistration.addUrlPatterns("/*");
        return filterRegistration;
    }


    @Bean
    public Realm realm(CacheManager cacheManager, CredentialsMatcher credentialsMatcher) {
        MyRealm myRealm = new MyRealm();
        myRealm.setCredentialsMatcher(credentialsMatcher);
        myRealm.setCacheManager(cacheManager);
        return myRealm;
    }


    @Bean
    public CredentialsMatcher credentialsMatcher() {
        HashedCredentialsMatcher matcher = new HashedCredentialsMatcher();
        matcher.setHashAlgorithmName(PcdnConst.HASH_ALGORITHM);
        matcher.setHashIterations(PcdnConst.HASH_ITERATIONS);
        return matcher;
    }


    @Bean
    public SecurityManager securityManager(Realm realm, CacheManager cacheManager, SessionManager sessionManager) {
        DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager();
        // 设置realm.
        securityManager.setRealm(realm);
        // 设置缓存
        securityManager.setCacheManager(cacheManager);
        // 配置session管理
        securityManager.setSessionManager(sessionManager);
        return securityManager;
    }


    /**
     * Session Manager
     * 使用的是shiro-redis开源插件
     */
    @Bean
    public SessionManager sessionManager(SessionListener sessionListener,
                                         SessionDAO sessionDAO,
                                         CacheManager cacheManager,
                                         Cookie sessionIdCookie) {
        DefaultWebSessionManager sessionManager = new DefaultWebSessionManager();
        sessionManager.setCacheManager(cacheManager);
        sessionManager.setSessionDAO(sessionDAO);
        sessionManager.setGlobalSessionTimeout(globalSessionTimeOut * 1000L);
        sessionManager.setSessionIdCookie(sessionIdCookie);
        sessionManager.setSessionListeners(new ArrayList<SessionListener>() {{
            add(sessionListener);
        }});
        return sessionManager;
    }

    @Bean("sessionIdCookie")
    public Cookie simpleCookie() {
        SimpleCookie cookie = new SimpleCookie(ShiroHttpSession.DEFAULT_SESSION_ID_NAME);
        //sessionIdCookie过期时间这里设置和会话有效期一样，不设置的话默认为-1，cookie关闭浏览器过期
        cookie.setMaxAge(globalSessionTimeOut);
        return cookie;
    }/**
     * Shiro生命周期处理器，注意这里使用static修饰，@Value值不能初始化（原因可自行研究）
     */
    @Bean
    public static LifecycleBeanPostProcessor getLifecycleBeanPostProcessor() {
        return new LifecycleBeanPostProcessor();
    }

    @Bean
    public DefaultAdvisorAutoProxyCreator getDefaultAdvisorAutoProxyCreator() {
        DefaultAdvisorAutoProxyCreator daap = new DefaultAdvisorAutoProxyCreator();
        daap.setProxyTargetClass(true);
        return daap;
    }

    @Bean
    public AuthorizationAttributeSourceAdvisor getAuthorizationAttributeSourceAdvisor(org.apache.shiro.mgt.SecurityManager securityManager) {
        AuthorizationAttributeSourceAdvisor aasa = new AuthorizationAttributeSourceAdvisor();
        aasa.setSecurityManager(securityManager);
        return aasa;
    }
}

加载配置的入口类ShiroFilterFactoryBean，从名字可以猜测这是一个spring的工厂类，

类签名：public class ShiroFilterFactoryBean implements FactoryBean, BeanPostProcessor

spring在实例化的时候会调用其getObject实现，源代码ShiroFilterFactoryBean ，第341行

    public Object getObject() throws Exception {
        if (instance == null) {
            instance = createInstance();
        }
        return instance;
    }

createInstance会创建一个AbstractShiroFilter的实现类SpringShiroFilter的实例，源代码ShiroFilterFactoryBean ，第422行

    protected AbstractShiroFilter createInstance() throws Exception {

        log.debug("Creating Shiro Filter instance.");

        //（1）获取前面shiroConfig中配置的securityManager
        SecurityManager securityManager = getSecurityManager();
        if (securityManager == null) {
            String msg = "SecurityManager property must be set.";
            throw new BeanInitializationException(msg);
        }

        if (!(securityManager instanceof WebSecurityManager)) {
            String msg = "The security manager does not implement the WebSecurityManager interface.";
            throw new BeanInitializationException(msg);
        }
        
        //（2）添加shiro的11个默认filter和自定义的filter
        FilterChainManager manager = createFilterChainManager();

        //Expose the constructed FilterChainManager by first wrapping it in a
        // FilterChainResolver implementation. The AbstractShiroFilter implementations
        // do not know about FilterChainManagers - only resolvers:
        PathMatchingFilterChainResolver chainResolver = new PathMatchingFilterChainResolver();
        chainResolver.setFilterChainManager(manager);

        //Now create a concrete ShiroFilter instance and apply the acquired SecurityManager and built
        //FilterChainResolver.  It doesn't matter that the instance is an anonymous inner class
        //here - we're just using it because it is a concrete AbstractShiroFilter instance that accepts
        //injection of the SecurityManager and FilterChainResolver:

       //（3）创建一个springShiroFilter实例
        return new SpringShiroFilter((WebSecurityManager) securityManager, chainResolver);
    }

上面代码的（1）（2）步骤是不是有点眼熟，和原生java web加载shiro配置的功能类似。最后（3）会生成springShiroFilter实例托管给spring容器。

为什么要将ShiroFilter托管给spring容器？

很好理解，我们是基于spring配置来接入shiro的，理所应当的可以使用spring的ioc特性来管理shiro相关bean。配置中需要使用spring容器中的实例时可以直接注入。

所以

这里shiroFile不能使用前面原生的java web的web.xml中的org.apache.shiro.web.servlet.ShiroFilter，因为init（）方法没法初始化。相关配置需要从spring容器中获取，所以使用了DelegatingFilterProxy来代理shiroFilter。

DelegatingFilterProxy是spring对于servlet filter的通用代理类，指定targetBeanName后，可以从容器中获取filter实例。