shiro多realm抛出异常问题-阿里云开发者社区

shiro多realm抛出异常问题

2022-08-18 391

版权

本文内容由阿里云实名注册用户自发贡献，版权归原作者所有，阿里云开发者社区不拥有其著作权，亦不承担相应法律责任。具体规则请查看《阿里云开发者社区用户服务协议》和《阿里云开发者社区知识产权保护指引》。如果您发现本社区中有涉嫌抄袭的内容，填写侵权投诉表单进行举报，一经查实，本社区将立刻删除涉嫌侵权内容。

简介： 使用Shiro作为安全框架时，为了方便我们可以把异常提出为公共模块，当使用多Realm时，需要特殊处理下，不然，异常时只会抛出一种。最近写项目时，就遇到了该问题，本身项目有一个登录系统，需要多加一个OAuth2的单点登录，服务端已经OK，需要在项目中对接一下该服务端；特此记录下

既然是多Realm，我们需要在每个Realm中重写Support方法

//UserRealm 自身验证
    @Override
    public boolean supports(AuthenticationToken token) {
        return token instanceof UsernamePasswordToken;
    }
//SSO 单点登录验证
    @Override
    public boolean supports(AuthenticationToken token) {
        return token instanceof OAuth2SsoAuthenticationToken;
    }

自定义一个类继承 ModularRealmAuthenticator，并重写doMultiRealmAuthentication方法

/**
 * @author yafengliang@yeah.net
 * @Description
 * @date 2022-08-18 9:18
 */
public class MultiRealmAuthenticator extends ModularRealmAuthenticator {

    private static final Logger log = LoggerFactory.getLogger(ModularRealmAuthenticator.class);


    @Override
    protected AuthenticationInfo doMultiRealmAuthentication(Collection<Realm> realms, AuthenticationToken token) {

        AuthenticationStrategy strategy = getAuthenticationStrategy();
        AuthenticationInfo authentication = strategy.beforeAllAttempts(realms, token);
        if (log.isTraceEnabled()) {
            log.trace("Iterating through {} realms for PAM authentication", realms.size());
        }
        AuthenticationException authenticationException = null;
        for (Realm realm : realms) {
            authentication = strategy.beforeAttempt(realm, token, authentication);
            if (realm.supports(token)) {
                log.trace("Attempting to authenticate token [{}] using realm [{}]", token, realm);
                AuthenticationInfo info = null;
                try {
                    info = realm.getAuthenticationInfo(token);
                   //因为默认使用的是AtLeastOneSuccessfulStrategy（），有一个Realm成功就可以
                  authenticationException = null;
                } catch (AuthenticationException e) {
                    authenticationException = e;
                    if (log.isDebugEnabled()) {
                        String msg = "Realm [" + realm + "] threw an exception during a multi-realm authentication attempt:";
                        log.debug(msg, e);
                    }
                }
                authentication = strategy.afterAttempt(realm, token, info, authentication, authenticationException);
            } else {
                log.debug("Realm [{}] does not support token {}.  Skipping realm.", realm, token);
            }
        }
        if (authenticationException != null) {
            throw authenticationException;
        }
        authentication = strategy.afterAllAttempts(token, authentication);
        return authentication;

    }
}

在shiro的配置类中注入自定义类

@Bean
    public AbstractAuthenticator authenticator(UserRealm userRealm, OAuth2Realm oAuth2Realm){
        ModularRealmAuthenticator authenticator = new MultiRealmAuthenticator();
        authenticator.setRealms(Arrays.asList(userRealm,oAuth2Realm));
        authenticator.setAuthenticationStrategy(new AtLeastOneSuccessfulStrategy());
        return authenticator;
    }

在securityManager中加入多realm

    /**
     * 安全管理器
     */
    @Bean
    public SecurityManager securityManager(UserRealm userRealm, OAuth2Realm oAuth2Realm,AbstractAuthenticator authenticator) {
        DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager();
        // 设置realm.
        // securityManager.setRealm(userRealm);
        securityManager.setRealms(Arrays.asList(userRealm, oAuth2Realm));
        // 注入缓存管理器;
        securityManager.setCacheManager(getEhCacheManager());
        // session管理器
        securityManager.setSessionManager(sessionManager());
        //解决多realm的异常问题重点在此
        securityManager.setAuthenticator(authenticator);

        return securityManager;
    }