不解释，全网最全Shiro认证与授权原理分析

<dependency>
    <groupId>org.apache.shiro</groupId>
    <artifactId>shiro-core</artifactId>
    <version>1.7.0</version>
</dependency>
<dependency>
    <groupId>org.slf4j</groupId>
    <artifactId>jcl-over-slf4j</artifactId>
    <version>1.7.29</version>
</dependency>
<dependency>
    <groupId>org.slf4j</groupId>
    <artifactId>slf4j-log4j12</artifactId>
    <version>1.7.29</version>
</dependency>
<dependency>
    <groupId>log4j</groupId>
    <artifactId>log4j</artifactId>
    <version>1.2.17</version>
</dependency>

# =============================================================================
# Tutorial INI configuration
#
# Usernames/passwords are based on the classic Mel Brooks' film "Spaceballs" :)
# =============================================================================

# -----------------------------------------------------------------------------
# Users and their (optional) assigned roles
# username = password, role1, role2, ..., roleN
# -----------------------------------------------------------------------------
[users]
root = secret, admin
guest = guest, guest
presidentskroob = 12345, president
darkhelmet = ludicrousspeed, darklord, schwartz
lonestarr = vespa, goodguy, schwartz

# -----------------------------------------------------------------------------
# Roles with assigned permissions
# roleName = perm1, perm2, ..., permN
# -----------------------------------------------------------------------------
[roles]
admin = *
schwartz = lightsaber:*
goodguy = winnebago:drive:eagle5

Factory<SecurityManager> factory = new IniSecurityManagerFactory("classpath:shiro.ini");
SecurityManager securityManager = factory.getInstance();
SecurityUtils.setSecurityManager(securityManager);

Environment environment = new BasicIniEnvironment("classpath:shiro.ini");
SecurityManager securityManager = environment.getSecurityManager();
SecurityUtils.setSecurityManager(securityManager);

public class Tutorial {

   private static final transient Logger log = LoggerFactory.getLogger(Tutorial.class);

   public static void main(String[] args) {
       log.info("My First Apache Shiro Application");

       // 1.初始化环境，主要是加载shiro.ini配置文件的信息
       Environment environment = new BasicIniEnvironment("classpath:shiro.ini");
      // 2.获取SecurityManager安全管理器
      SecurityManager securityManager = environment.getSecurityManager();
      SecurityUtils.setSecurityManager(securityManager);

      // 3.获取当前主体（用户）
      Subject currentUser = SecurityUtils.getSubject();

      // 4.获取当前主体的会话
      Session session = currentUser.getSession();
      // 5.向会话中存储一些内容（不需要web容器或EJB容器）
      session.setAttribute("someKey", "aValue");
      // 6.再次从会话中获取存储的内容，并比较与存储值是否一致。
      String value = (String) session.getAttribute("someKey");
      if ("aValue".equals(value)) {
         log.info("Retrieved the correct value! [" + value + "]");
      }

      // 当前用户进行登录操作，进而可以检验用户的角色和权限。    
      // 7.判断当前用户是否认证（此时很显然未认证）
      if (!currentUser.isAuthenticated()) {
         // 8.将账号和密码封装到UsernamePasswordToken中
         UsernamePasswordToken token = new UsernamePasswordToken("lonestarr", "vespa");
         // 9.记住我
         token.setRememberMe(true);
         try {
            // 10.进行登录操作
            currentUser.login(token);
         } catch (UnknownAccountException uae) {
            log.info("There is no user with username of " + token.getPrincipal());
         } catch (IncorrectCredentialsException ice) {
            log.info("Password for account " + token.getPrincipal() + " was incorrect!");
         } catch (LockedAccountException lae) {
            log.info("The account for username " + token.getPrincipal() + " is locked.  " +
                  "Please contact your administrator to unlock it.");
         }
         // ... 更多其他异常，包括应用程序异常
         catch (AuthenticationException ae) {
            // 其他意外异常、error处理
         }
      }

      // 打印当前用户的主体信息
      log.info("User [" + currentUser.getPrincipal() + "] logged in successfully.");

      // 10.检查是否有指定角色权限（前面已经通过Environment加载了权限和角色信息）
      if (currentUser.hasRole("schwartz")) {
         log.info("May the Schwartz be with you!");
      } else {
         log.info("Hello, mere mortal.");
      }

      // 判断是否有资源操作权限
      if (currentUser.isPermitted("lightsaber:wield")) {
         log.info("You may use a lightsaber ring.  Use it wisely.");
      } else {
         log.info("Sorry, lightsaber rings are for schwartz masters only.");
      }

      // 更强级别的权限验证
      if (currentUser.isPermitted("winnebago:drive:eagle5")) {
         log.info("You are permitted to 'drive' the winnebago with license plate (id) 'eagle5'.  " +
               "Here are the keys - have fun!");
      } else {
         log.info("Sorry, you aren't allowed to drive the 'eagle5' winnebago!");
      }

      // 11.登出
      currentUser.logout();
      System.exit(0);
   }
}

INFO - My First Apache Shiro Application
INFO - Enabling session validation scheduler...
INFO - Retrieved the correct value! [aValue]
INFO - User [lonestarr] logged in successfully.
INFO - May the Schwartz be with you!
INFO - You may use a lightsaber ring.  Use it wisely.
INFO - You are permitted to 'drive' the winnebago with license plate (id) 'eagle5'.  Here are the keys - have fun!

// 1.初始化环境，主要是加载shiro.ini配置文件的信息
Environment environment = new BasicIniEnvironment("classpath:shiro.ini");
// 2.获取SecurityManager安全管理器
SecurityManager securityManager = environment.getSecurityManager();
SecurityUtils.setSecurityManager(securityManager);

// 获取当前主体（用户）
Subject currentUser = SecurityUtils.getSubject();
// 判断当前用户是否认证
currentUser.isAuthenticated()
// 将账号和密码封装到UsernamePasswordToken中
UsernamePasswordToken token = new UsernamePasswordToken("lonestarr", "vespa");
// 记住我
token.setRememberMe(true);
// 登录操作
currentUser.login(token);

//currentUser类型为Subject，在构造了SecurityManager之后，提交认证，token封装了用户信息
currentUser.login(token);

//DelegatingSubject类中，调用SecurityManager执行认证
Subject subject = this.securityManager.login(this, token);

//DefaultSecurityManager类中，SecurityManager委托给Authenticator执行认证逻辑
AuthenticationInfo info = this.authenticate(token);

// AuthenticatingSecurityManager类中，进行认证
this.authenticator.authenticate(token);

//AbstractAuthenticator类中，进行认证
AuthenticationInfo info = this.doAuthenticate(token);

//ModularRealmAuthenticator类中，获取多Realm进行身份认证
Collection<Realm> realms = this.getRealms();
doSingleRealmAuthentication(realm, token);

//ModularRealmAuthenticator类中，针对具体的Realm进行身份认证
AuthenticationInfo info = realm.getAuthenticationInfo(token);

//AuthenticatingRealm类中，调用对应的Realm进行校验，认证成功则返回用户属性
AuthenticationInfo info = realm.doGetAuthenticationInfo(token);

//SimpleAccountRealm类中，根据token获取账户信息
UsernamePasswordToken upToken = (UsernamePasswordToken) token;
SimpleAccount account = getUser(upToken.getUsername());

//AuthenticatingRealm类中，比对传入的token和根据token获取到的账户信息
assertCredentialsMatch(token, info);
->getCredentialsMatcher().doCredentialsMatch(token, info);

//SimpleCredentialsMatcher类中，进行具体对比
byte[] tokenBytes = toBytes(tokenCredentials);
byte[] accountBytes = toBytes(accountCredentials);
MessageDigest.isEqual(tokenBytes, accountBytes);
//或
accountCredentials.equals(tokenCredentials);

// 检查是否有相应角色权限
currentUser.hasRole("schwartz")
// 判断是否有资源操作权限
currentUser.isPermitted("lightsaber:wield")
// 判断是否有（更细粒度的）资源操作权限
currentUser.isPermitted("winnebago:drive:eagle5")

// 检查是否有相应角色权限
currentUser.hasRole("schwartz");

// DelegatingSubject类中，委托给SecurityManager判断角色与既定角色是否匹配
this.securityManager.hasRole(this.getPrincipals(), roleIdentifier);

// AuthorizingSecurityManager类中，SecurityManager委托Authorizer进行角色检验
this.authorizer.hasRole(principals, roleIdentifier);

// ModularRealmAuthorizer类中，获取所有Realm，并遍历检查角色
for (Realm realm : getRealms());
((Authorizer) realm).hasRole(principals, roleIdentifier)

// AuthorizingRealm中，Authorizer判断Realm中的角色/权限是否和传入的匹配
AuthorizationInfo info = getAuthorizationInfo(principal);

// AuthorizingRealm中，执行Realm进行授权操作
AuthorizationInfo info = this.doGetAuthorizationInfo(principals);

// SimpleAccountRealm类中，获得用户SimpleAccount（实现了AuthorizationInfo）,
// users类型为Map，以用户名为key，对应shiro.ini中配置的初始化用户信息
return this.users.get(username);

// AuthorizingRealm类中,判断传入的用户和初始化配置的是否匹配
return hasRole(roleIdentifier, info);

// AuthorizingRealm类中，最终的授权判断
return info != null && info.getRoles() != null && info.getRoles().contains(roleIdentifier);

public class AuthenticationTest {

    SimpleAccountRealm simpleAccountRealm = new SimpleAccountRealm();

    @Before
    public void addUser() {
        // 在方法开始前添加一个用户
        simpleAccountRealm.addAccount("wmyskxz", "123456");
    }

    @Test
    public void testAuthentication() {
        // 1.构建SecurityManager环境
        DefaultSecurityManager defaultSecurityManager = new DefaultSecurityManager();
        defaultSecurityManager.setRealm(simpleAccountRealm);

        // 2.主体提交认证请求
        // 设置SecurityManager环境
        SecurityUtils.setSecurityManager(defaultSecurityManager);
        // 获取当前主体
        Subject subject = SecurityUtils.getSubject();
        UsernamePasswordToken token = new UsernamePasswordToken("wmyskxz", "123456");
        // 登录
        subject.login(token);
        // subject.isAuthenticated()方法返回一个boolean值,用于判断用户是否认证成功
        System.out.println("isAuthenticated:" + subject.isAuthenticated());
    }
}