《Apache Shiro 源码解析》- 2.主体、身份与凭据

public class User {
    private String username;
    private Password password;

    public User(String username, String password) {
        this.username = username;
        this.password = new Password(password);
    }

    public String getUsername() {
        return username;
    }

    public boolean validatePassword(String inputPassword) {
        return password.isValid(inputPassword);
    }
}

public class Password {
    private String hashedPassword;

    public Password(String plainTextPassword) {
        this.hashedPassword = hashPassword(plainTextPassword);  // 将明文密码进行加密存储
    }

    // 简单的哈希函数示例（仅作演示，实际应使用安全的加密算法）
    private String hashPassword(String plainTextPassword) {
        return Integer.toHexString(plainTextPassword.hashCode());
    }

    // 验证输入密码是否正确
    public boolean isValid(String inputPassword) {
        return this.hashedPassword.equals(hashPassword(inputPassword));
    }
}

public class LoginService {
    private Map<String, User> userDatabase = new HashMap<>();

    public LoginService() {
        // 初始化一些用户信息（此处直接创建用户，实际场景可能从数据库读取）
        userDatabase.put("user_1", new User("user_1", "123456"));
        userDatabase.put("user_2", new User("user_2", "654321"));
    }

    // 登录方法：接收用户名和密码，返回登录结果
    public boolean login(String username, String password) {
        User user = userDatabase.get(username);
        if (user == null) {
            System.out.println("User not found.");
            return false;
        }
        if (user.validatePassword(password)) {
            System.out.println("Login successful! Welcome, " + username);
            return true;
        } else {
            System.out.println("Invalid password.");
            return false;
        }
    }
}

public class Main {
    public static void main(String[] args) {
        String username = "user_1";
        String password = "123456";

        LoginService loginService = new LoginService();
        boolean isSuccess = loginService.login(username, password);
        if (isSuccess) {
            System.out.println("Access granted.");
        } else {
            System.out.println("Access denied.");
        }
    }
}

public class DelegatingSubject implements Subject {
    //...

    protected transient SecurityManager securityManager;

    //...

    //since 1.2
    public DelegatingSubject(PrincipalCollection principals, boolean authenticated, String host,
                             Session session, boolean sessionCreationEnabled, SecurityManager securityManager) {
        if (securityManager == null) {
            throw new IllegalArgumentException("SecurityManager argument cannot be null.");
        }
        this.securityManager = securityManager;

        //...
    }

}

public class WebDelegatingSubject extends DelegatingSubject implements WebSubject {
    //...

    private final ServletRequest servletRequest;
    private final ServletResponse servletResponse;

    //...

    //since 1.2
    public WebDelegatingSubject(PrincipalCollection principals, boolean authenticated,
                                String host, Session session, boolean sessionEnabled,
                                ServletRequest request, ServletResponse response,
                                SecurityManager securityManager) {
        super(principals, authenticated, host, session, sessionEnabled, securityManager);
        this.servletRequest = request;
        this.servletResponse = response;
    }

    public ServletRequest getServletRequest() {
        return servletRequest;
    }

    public ServletResponse getServletResponse() {
        return servletResponse;
    }

    //...

    @Override
    protected SessionContext createSessionContext() {
        WebSessionContext wsc = new DefaultWebSessionContext();
        String host = getHost();
        if (StringUtils.hasText(host)) {
            wsc.setHost(host);
        }
        wsc.setServletRequest(this.servletRequest);
        wsc.setServletResponse(this.servletResponse);
        return wsc;
    }
}

import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;

@Bean
public SecurityManager securityManager(){
    DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager();
    securityManager.setRealm(nicefishRbacRealm());
    securityManager.setRememberMeManager(rememberMeManager());
    securityManager.setSessionManager(sessionManager());
    securityManager.setCacheManager(ehCacheManager());
    return securityManager;
}

public DefaultWebSecurityManager() {
    //...
    setSubjectFactory(new DefaultWebSubjectFactory());
    //...
}

public Subject createSubject(SubjectContext context) {
    //SHIRO-646
    //Check if the existing subject is NOT a WebSubject. If it isn't, then call super.createSubject instead.
    //Creating a WebSubject from a non-web Subject will cause the ServletRequest and ServletResponse to be null, which wil fail when creating a session.
    boolean isNotBasedOnWebSubject = context.getSubject() != null && !(context.getSubject() instanceof WebSubject);
    if (!(context instanceof WebSubjectContext) || isNotBasedOnWebSubject) {
        return super.createSubject(context);
    }
    WebSubjectContext wsc = (WebSubjectContext) context;
    SecurityManager securityManager = wsc.resolveSecurityManager();
    Session session = wsc.resolveSession();
    boolean sessionEnabled = wsc.isSessionCreationEnabled();
    PrincipalCollection principals = wsc.resolvePrincipals();
    boolean authenticated = wsc.resolveAuthenticated();
    String host = wsc.resolveHost();
    ServletRequest request = wsc.resolveServletRequest();
    ServletResponse response = wsc.resolveServletResponse();

    return new WebDelegatingSubject(principals, authenticated, host, session, sessionEnabled,
            request, response, securityManager);
}

//...
private Map<String, Set> realmPrincipals;

//...
protected Collection getPrincipalsLazy(String realmName) {
    if (realmPrincipals == null) {
        realmPrincipals = new LinkedHashMap<String, Set>();
    }
    Set principals = realmPrincipals.get(realmName);
    if (principals == null) {
        principals = new LinkedHashSet();
        realmPrincipals.put(realmName, principals);//以 realmName 作为 key ，身份集合作为 value
    }
    return principals;
}

public class DelegatingSubject implements Subject {
    //...

    //这里持有了一个 PrincipalCollection 的实例
    protected PrincipalCollection principals;

    //...
}

# 切换当前用户为 root
su root

public void runAs(PrincipalCollection principals) {
    if (!hasPrincipals()) {
        String msg = "This subject does not yet have an identity.  Assuming the identity of another " +
                "Subject is only allowed for Subjects with an existing identity.  Try logging this subject in " +
                "first, or using the " + Subject.Builder.class.getName() + " to build ad hoc Subject instances " +
                "with identities as necessary.";
        throw new IllegalStateException(msg);
    }
    pushIdentity(principals);
}

//...

private void pushIdentity(PrincipalCollection principals) throws NullPointerException {
    if (isEmpty(principals)) {
        String msg = "Specified Subject principals cannot be null or empty for 'run as' functionality.";
        throw new NullPointerException(msg);
    }
    List<PrincipalCollection> stack = getRunAsPrincipalsStack();
    if (stack == null) {
        stack = new CopyOnWriteArrayList<PrincipalCollection>();
    }
    stack.add(0, principals);       //把新的身份集合压入到栈顶
    Session session = getSession(); //主体切换身份之后，会话也需要切换
    session.setAttribute(RUN_AS_PRINCIPALS_SESSION_KEY, stack);
}

UsernamePasswordToken token = new UsernamePasswordToken(userName, password, rememberMe);
SecurityUtils.getSubject().login(token);

public class NiceFishMySQLRealm extends AuthorizingRealm {
    private static final Logger logger = LoggerFactory.getLogger(NiceFishMySQLRealm.class);

    @Autowired
    private IUserService userService;

    @Override
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
        UsernamePasswordToken usernamePasswordToken = (UsernamePasswordToken) token;
        String username = usernamePasswordToken.getUsername();
        String password = usernamePasswordToken.getPassword()!=null?new String(usernamePasswordToken.getPassword()):"";

        UserEntity userEntity;
        try {
            userEntity = userService.checkUser(username, password);
            logger.debug("UserName>"+username);
            logger.debug("Password>"+password);
        }catch (Exception e) {
            logger.error(username + "登录失败{}", e.getMessage());
            throw new AuthenticationException(e.getMessage(), e);
        }

        //用户认证成功，返回验证信息实例。
        SimpleAuthenticationInfo info = new SimpleAuthenticationInfo(userEntity, password, getName());
        return info;
    }

    //...
}