shiro验证加密过程是怎样的_JAVA_编程开发_程序员俱乐部

中国优秀的程序员网站程序员频道CXYCLUB技术地图
热搜:
更多>>
 
您所在的位置: 程序员俱乐部 > 编程开发 > JAVA > shiro验证加密过程是怎样的

shiro验证加密过程是怎样的

 2017/11/6 15:22:01  sunjy22  程序员俱乐部  我要评论(0)
  • 摘要:在单步调试shiro登录源码结合张开涛的demo,学习了shiro验证加密过程是怎样的。在核心类AuthenticatingRealm的getAuthenticationInfo(AuthenticationTokentoken)方法中完成登录表单提交的密码校验。shiro类方法调用示意图1.getAuthenticationInfo核心方法publicfinalAuthenticationInfogetAuthenticationInfo(AuthenticationTokentoken
  • 标签:过程
在单步调试shiro登录源码结合张开涛的demo,学习了shiro验证加密过程是怎样的。
在核心类AuthenticatingRealm的getAuthenticationInfo(AuthenticationToken token)方法中完成登录表单提交的密码校验。
shiro类方法调用示意图


1.getAuthenticationInfo核心方法
class="java">
    public final AuthenticationInfo getAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
//传入的AuthenticationToken token为表单提交参数封装的类,存储了用户名、明文密码、记住我我、主机IP。
        AuthenticationInfo info = getCachedAuthenticationInfo(token);
        if (info == null) {
//从自定义的UserRealm中获取AuthenticationInfo(一般是数据库),当作一个比较标本,用途把token生成的密文是与这个标本的密码、密文进行比较,若一致则算登录成功。
            //otherwise not cached, perform the lookup:
            info = doGetAuthenticationInfo(token);
            log.debug("Looked up AuthenticationInfo [{}] from doGetAuthenticationInfo", info);
            if (token != null && info != null) {
                cacheAuthenticationInfoIfPossible(token, info);
            }
        } else {
            log.debug("Using cached authentication info [{}] to perform credentials matching.", info);
        }

        if (info != null) {
//比较在这个方法体内进行
            assertCredentialsMatch(token, info);
        } else {
            log.debug("No AuthenticationInfo found for submitted AuthenticationToken [{}].  Returning null.", token);
        }

        return info;
    }

2.doGetAuthenticationInfo,自定义realm,根据token中的用户名,从数据库中获得密文、salt、realm名封装成info
@Override
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {

        String username = (String)token.getPrincipal();

        User user = userService.findByUsername(username);

        if(user == null) {
            throw new UnknownAccountException();//没找到帐号
        }

        if(Boolean.TRUE.equals(user.getLocked())) {
            throw new LockedAccountException(); //帐号锁定
        }

        //交给AuthenticatingRealm使用CredentialsMatcher进行密码匹配,如果觉得人家的不好可以自定义实现
        SimpleAuthenticationInfo authenticationInfo = new SimpleAuthenticationInfo(
                user.getUsername(), //用户名
                user.getPassword(), //密码
                ByteSource.Util.bytes(user.getCredentialsSalt()),//salt=username+salt
                getName()  //realm name
        );
        return authenticationInfo;
    }

3.assertCredentialsMatch,凭证匹配器,提交的凭证和存储的凭证进行匹配比较
//Asserts that the submitted AuthenticationToken's credentials match the stored account AuthenticationInfo's credentials
//我的理解翻译是提交的凭证和存储的凭证进行匹配比较
    protected void assertCredentialsMatch(AuthenticationToken token, AuthenticationInfo info) throws AuthenticationException {
//返回设定的凭证匹配器(匹配规则),包含了hashAlgorithmName(加密方式名如md5)、hashIterations(加密次数)、storedCredentialsHexEncoded(密文进行16进制存储)、hashSalted(默认值false)、passwordRetryCache(密码重试缓存)5个属性。
        CredentialsMatcher cm = getCredentialsMatcher()
        if (cm != null) {
//执行密文匹配,在此时此地,token中的密码还是明文的,未加密
            if (!cm.doCredentialsMatch(token, info)) {
                //not successful - throw an exception to indicate this:
                String msg = "Submitted credentials for token [" + token + "] did not match the expected credentials.";
                throw new IncorrectCredentialsException(msg);
            }
        } else {
            throw new AuthenticationException("A CredentialsMatcher must be configured in order to verify " +
                    "credentials during authentication.  If you do not wish for credentials to be examined, you " +
                    "can configure an " + AllowAllCredentialsMatcher.class.getName() + " instance.");
        }
    }

4.doCredentialsMatch,密码错误次数后父类HashedCredentialsMatcher的doCredentialsMatch
//在自定义的RetryLimitHashedCredentialsMatcher的doCredentialsMatch方法中加入密码错误次数判断后进入父类HashedCredentialsMatcher的doCredentialsMatch。
//父类的doCredentialsMatch
    @Override
    public boolean doCredentialsMatch(AuthenticationToken token, AuthenticationInfo info) {
        Object tokenHashedCredentials = hashProvidedCredentials(token, info);
        Object accountCredentials = getCredentials(info);
        return equals(tokenHashedCredentials, accountCredentials);
    }

5.hashProvidedCredentials,从info中取出salt,和表单提交的密码一个需认证的Hash
//取出盐
protected Object hashProvidedCredentials(AuthenticationToken token, AuthenticationInfo info) {
        Object salt = null;
        if (info instanceof SaltedAuthenticationInfo) {
            salt = ((SaltedAuthenticationInfo) info).getCredentialsSalt();
        } else {
            //retain 1.0 backwards compatibility:
            if (isHashSalted()) {
                salt = getSalt(token);
            }
        }
        return hashProvidedCredentials(token.getCredentials(), salt, getHashIterations());
    }
//生成hash
//Object credentials 用户名
//Object salt 盐
//int hashIterations hash次数
    protected Hash hashProvidedCredentials(Object credentials, Object salt, int hashIterations) {
//算法名,如md5
        String hashAlgorithmName = assertHashAlgorithmName();
//创建用户账号时生成的密文也是生成一个SimpleHash,构造参数多一个hashIterations
        return new SimpleHash(hashAlgorithmName, credentials, salt, hashIterations);
    }

6.getCredentials,从存储的info中提取密文,转换成一个hash对象
//    protected Object getCredentials(AuthenticationInfo info) {
        Object credentials = info.getCredentials();

        byte[] storedBytes = toBytes(credentials);

        if (credentials instanceof String || credentials instanceof char[]) {
            //account.credentials were a char[] or String, so
            //we need to do text decoding first:
            if (isStoredCredentialsHexEncoded()) {
                storedBytes = Hex.decode(storedBytes);
            } else {
                storedBytes = Base64.decode(storedBytes);
            }
        }
        AbstractHash hash = newHashInstance();
        hash.setBytes(storedBytes);
        return hash;
    }
//两个hash对象进行比较

7.equals,两个hash对象进行比较
    protected boolean equals(Object tokenCredentials, Object accountCredentials) {
        if (log.isDebugEnabled()) {
            log.debug("Performing credentials equality check for tokenCredentials of type [" +
                    tokenCredentials.getClass().getName() + " and accountCredentials of type [" +
                    accountCredentials.getClass().getName() + "]");
        }
        if (isByteSource(tokenCredentials) && isByteSource(accountCredentials)) {
            if (log.isDebugEnabled()) {
                log.debug("Both credentials arguments can be easily converted to byte arrays.  Performing " +
                        "array equals comparison");
            }
//最终都转换成字节数组进行比较
            byte[] tokenBytes = toBytes(tokenCredentials);
            byte[] accountBytes = toBytes(accountCredentials);
            return Arrays.equals(tokenBytes, accountBytes);
        } else {
            return accountCredentials.equals(tokenCredentials);
        }
    }
  • 大小: 31 KB
  • 查看图片附件
发表评论
用户名: 匿名