shiro 整合 spring 實戰及原始碼詳解

序言

前面我們學習瞭如下內容：

相信大家對於 shiro 已經有了最基本的認識，這一節我們一起來學習寫如何將 shiro 與 spring 進行整合。

spring 整合

maven 依賴

<dependencies>
    <dependency>
        <groupId>org.apache.shiro</groupId>
        <artifactId>shiro-spring</artifactId>
        <version>1.7.0</version>
    </dependency>
    <dependency>
        <groupId>org.springframework</groupId>
        <artifactId>spring-context</artifactId>
        <version>4.3.13.RELEASE</version>
    </dependency>
</dependencies>

服務類定義

定義一個簡單的服務類，用於演示 @RequiresPermissions 註解的許可權校驗。

package com.github.houbb.shiro.inaction02.springalone;

import org.apache.shiro.authz.annotation.RequiresPermissions;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.stereotype.Component;

/**
 * Simple Service with methods protected with annotations.
 */
@Component
public class SimpleService {

    private static Logger log = LoggerFactory.getLogger(SimpleService.class);

    @RequiresPermissions("write")
    public void writeRestrictedCall() {
        log.info("executing method that requires the 'write' permission");
    }

    @RequiresPermissions("read")
    public void readRestrictedCall() {
        log.info("executing method that requires the 'read' permission");
    }
}

快速開始

我們對原來的 Quick Start 進行改造如下：

package com.github.houbb.shiro.inaction02.springalone;

import org.apache.shiro.SecurityUtils;
import org.apache.shiro.authc.UsernamePasswordToken;
import org.apache.shiro.authz.AuthorizationException;
import org.apache.shiro.mgt.SecurityManager;
import org.apache.shiro.subject.Subject;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.stereotype.Component;

import javax.annotation.PostConstruct;

/**
 * Simple Bean used to demonstrate subject usage.
 */
@Component
public class QuickStart {

    private static Logger log = LoggerFactory.getLogger(QuickStart.class);

    @Autowired
    private SecurityManager securityManager;

    @Autowired
    private SimpleService simpleService;

    /**
     * Sets the static instance of SecurityManager. This is NOT needed for web applications.
     */
    @PostConstruct
    private void initStaticSecurityManager() {
        SecurityUtils.setSecurityManager(securityManager);
    }

    public void run() {
        // get the current subject
        Subject subject = SecurityUtils.getSubject();

        // Subject is not authenticated yet
        System.out.println(!subject.isAuthenticated());

        // login the subject with a username / password
        UsernamePasswordToken token = new UsernamePasswordToken("joe.coder", "password");
        subject.login(token);

        // joe.coder has the "user" role
        subject.checkRole("user");

        // joe.coder does NOT have the admin role
        System.out.println(!subject.hasRole("admin"));

        // joe.coder has the "read" permission
        subject.checkPermission("read");

        // current user is allowed to execute this method.
        simpleService.readRestrictedCall();

        try {
            // but not this one!
            simpleService.writeRestrictedCall();
        }
        catch (AuthorizationException e) {
            log.info("Subject was NOT allowed to execute method 'writeRestrictedCall'");
        }

        // logout
        subject.logout();
        System.out.println(!subject.isAuthenticated());
    }

}

這裡最核心的區別是 SecurityManager 是直接透過 @Autowired 注入得到的。

也沒有看到我們以前初始化 SecurityManager 的 ini 檔案，這些在下面的配置檔案中。

配置類

package com.github.houbb.shiro.inaction02.springalone;

import org.apache.shiro.realm.Realm;
import org.apache.shiro.realm.text.TextConfigurationRealm;
import org.apache.shiro.spring.config.ShiroAnnotationProcessorConfiguration;
import org.apache.shiro.spring.config.ShiroBeanConfiguration;
import org.apache.shiro.spring.config.ShiroConfiguration;
import org.springframework.context.annotation.*;

/**
 * Application bean definitions.
 */
@Configuration
@Import({ShiroBeanConfiguration.class,
         ShiroConfiguration.class,
         ShiroAnnotationProcessorConfiguration.class})
@ComponentScan("com.github.houbb.shiro.inaction02.springalone")
public class CliApp {

    /**
     * Example hard coded Realm bean.
     * @return hard coded Realm bean
     */
    @Bean
    public Realm realm() {
        TextConfigurationRealm realm = new TextConfigurationRealm();
        realm.setUserDefinitions("joe.coder=password,user\n" +
                                 "jill.coder=password,admin");

        realm.setRoleDefinitions("admin=read,write\n" +
                                 "user=read");
        realm.setCachingEnabled(true);
        return realm;
    }

}

這裡透過 @Bean 的方式宣告瞭使用者角色等資訊，可以簡單理解為和 Ini 檔案初始化是等價的。

@Import 匯入了 3 個配置類，我們後面進行介紹。

啟動

spring 應用的啟動：

public static void main(String[] args) {
    AnnotationConfigApplicationContext context = new AnnotationConfigApplicationContext(CliApp.class);
    context.getBean(QuickStart.class).run();
}

測試日誌如下：

十二月 31, 2020 10:33:02 上午 org.springframework.context.annotation.AnnotationConfigApplicationContext prepareRefresh
資訊: Refreshing org.springframework.context.annotation.AnnotationConfigApplicationContext@6267c3bb: startup date [Thu Dec 31 10:33:02 CST 2020]; root of context hierarchy
十二月 31, 2020 10:33:03 上午 org.springframework.context.support.PostProcessorRegistrationDelegate$BeanPostProcessorChecker postProcessAfterInitialization
資訊: Bean 'org.apache.shiro.spring.config.ShiroBeanConfiguration' of type [org.apache.shiro.spring.config.ShiroBeanConfiguration$$EnhancerBySpringCGLIB$$fbe016b3] is not eligible for getting processed by all BeanPostProcessors (for example: not eligible for auto-proxying)
...
資訊: Bean 'org.apache.shiro.spring.config.ShiroAnnotationProcessorConfiguration' of type [org.apache.shiro.spring.config.ShiroAnnotationProcessorConfiguration$$EnhancerBySpringCGLIB$$f9d46e86] is not eligible for getting processed by all BeanPostProcessors (for example: not eligible for auto-proxying)
十二月 31, 2020 10:33:03 上午 org.springframework.context.support.PostProcessorRegistrationDelegate$BeanPostProcessorChecker postProcessAfterInitialization
資訊: Bean 'eventBus' of type [org.apache.shiro.event.support.DefaultEventBus] is not eligible for getting processed by all BeanPostProcessors (for example: not eligible for auto-proxying)
十二月 31, 2020 10:33:03 上午 org.springframework.context.support.PostProcessorRegistrationDelegate$BeanPostProcessorChecker postProcessAfterInitialization
資訊: Bean 'org.apache.shiro.spring.config.ShiroConfiguration' of type [org.apache.shiro.spring.config.ShiroConfiguration$$EnhancerBySpringCGLIB$$3db21503] is not eligible for getting processed by all BeanPostProcessors (for example: not eligible for auto-proxying)
...
true
true
true

ShiroBeanConfiguration 配置類

@Import 共計匯入了 3 個配置類，我們接下來逐一分析下這 3 個配置類。

原始碼

@Configuration
public class ShiroBeanConfiguration extends AbstractShiroBeanConfiguration {

    @Bean
    @Override
    public LifecycleBeanPostProcessor lifecycleBeanPostProcessor() {
        return super.lifecycleBeanPostProcessor();
    }

    @Bean
    @Override
    protected EventBus eventBus() {
        return super.eventBus();
    }

    @Bean
    @Override
    public ShiroEventBusBeanPostProcessor shiroEventBusAwareBeanPostProcessor() {
        return super.shiroEventBusAwareBeanPostProcessor();
    }
}

這 3 個方法都是繼承自父類，直接呼叫的父類方法。

AbstractShiroBeanConfiguration.java

public class AbstractShiroBeanConfiguration {

    protected LifecycleBeanPostProcessor lifecycleBeanPostProcessor() {
        return new LifecycleBeanPostProcessor();
    }

    protected EventBus eventBus() {
        return new DefaultEventBus();
    }

    protected ShiroEventBusBeanPostProcessor shiroEventBusAwareBeanPostProcessor() {
        return new ShiroEventBusBeanPostProcessor(eventBus());
    }
}

實際上這裡初始化了 3 個物件：LifecycleBeanPostProcessor/DefaultEventBus/ShiroEventBusBeanPostProcessor。

LifecycleBeanPostProcessor

這個類實際上比較簡單，主要做了 2 件事情。

（1）執行 init() 和 destory()。

（2）指定對應的優先順序，預設為最低。

核心部分如下：

init 初始化

public Object postProcessBeforeInitialization(Object object, String name) throws BeansException {
    if (object instanceof Initializable) {
        try {
            if (log.isDebugEnabled()) {
                log.debug("Initializing bean [" + name + "]...");
            }
            ((Initializable) object).init();
        } catch (Exception e) {
            throw new FatalBeanException("Error initializing bean [" + name + "]", e);
        }
    }
    return object;
}

destory 銷燬

public void postProcessBeforeDestruction(Object object, String name) throws BeansException {
    if (object instanceof Destroyable) {
        try {
            if (log.isDebugEnabled()) {
                log.debug("Destroying bean [" + name + "]...");
            }
            ((Destroyable) object).destroy();
        } catch (Exception e) {
            throw new FatalBeanException("Error destroying bean [" + name + "]", e);
        }
    }
}

DefaultEventBus

這個類如其名，就是預設的事件匯流排類。

介面的如下：

public interface EventBus {
    void publish(Object var1);

    void register(Object var1);

    void unregister(Object var1);
}

分別對應的是事件的釋出，註冊和取消註冊。

實現部分實際就是呼叫對應的 EventListener 類，並且透過讀寫鎖保證併發安全，暫時不做展開。

ShiroEventBusBeanPostProcessor

這個類實際上是配合 EventBus 使用的，核心實現如下：

public class ShiroEventBusBeanPostProcessor implements BeanPostProcessor {

    final private EventBus eventBus;

    public ShiroEventBusBeanPostProcessor(EventBus eventBus) {
        this.eventBus = eventBus;
    }

    @Override
    public Object postProcessAfterInitialization(Object bean, String beanName) throws BeansException {
        //1. 如果實現了 EventBusAware 介面
        if (bean instanceof EventBusAware) {
            ((EventBusAware) bean).setEventBus(eventBus);
        }
        //2. 如果有 Subscribe 註解資訊
        else if (isEventSubscriber(bean)) {
            eventBus.register(bean);
        }

        return bean;
    }

}

這裡會把實現了 EventBusAware 介面，和指定了 @Subscribe 註解的物件，註解對應的 eventbus。

ShiroConfiguration 配置

思考

我們 QuickStart 中自動注入了 SecurityManager 物件，這個物件是在哪裡初始化的呢？

核心原始碼

核心部分如下：

@Configuration
@Import({ShiroBeanConfiguration.class})
public class ShiroConfiguration extends AbstractShiroConfiguration {

    @Bean
    @Override
    protected SessionsSecurityManager securityManager(List<Realm> realms) {
        return super.securityManager(realms);
    }

    @Bean
    @Override
    protected SessionManager sessionManager() {
        return super.sessionManager();
    }

    //... 省略其他元件
}

這裡可以發現實際上已經匯入了 ShiroBeanConfiguration 配置類，所以官方的 demo 可以簡化如下：

@Configuration
@Import({ShiroConfiguration.class,
         ShiroAnnotationProcessorConfiguration.class})
@ComponentScan("com.github.houbb.shiro.inaction02.springalone")
public class CliApp{}

實際測試了一下，也是透過的。

SecurityManager 初始化

我簡單的看了下 SecurityManager 實現子類還是比較多得。斷點可以發現預設的型別是 DefaultSecurityManager。

這些都可以在 AbstractShiroConfiguration 類中找到答案。

AbstractShiroConfiguration.java

核心實現如下：

public class AbstractShiroConfiguration {

    @Autowired
    protected EventBus eventBus;

    protected SessionsSecurityManager securityManager(List<Realm> realms) {
        SessionsSecurityManager securityManager = createSecurityManager();
        securityManager.setEventBus(eventBus);
        
        // 省略其他屬性設定
        return securityManager;
    }

    protected SessionsSecurityManager createSecurityManager() {
        DefaultSecurityManager securityManager = new DefaultSecurityManager();
        securityManager.setSubjectDAO(subjectDAO());
        securityManager.setSubjectFactory(subjectFactory());

        RememberMeManager rememberMeManager = rememberMeManager();
        if (rememberMeManager != null) {
            securityManager.setRememberMeManager(rememberMeManager);
        }

        return securityManager;
    }

}

securityManager(List<Realm> realms) 方法會把我們 CliApp 中定義的 Realm 物件當作引數傳入。

createSecurityManager() 方法就會初始化 DefaultSecurityManager 物件。

ShiroAnnotationProcessorConfiguration 配置

思考

我們在 SampleService 中使用了註解 @RequiresPermissions("write")，就可以校驗對應的許可權了。

但是這一切是如何被自動實現的呢？

原始碼

@Configuration
public class ShiroAnnotationProcessorConfiguration extends AbstractShiroAnnotationProcessorConfiguration{

    @Bean
    @DependsOn("lifecycleBeanPostProcessor")
    protected DefaultAdvisorAutoProxyCreator defaultAdvisorAutoProxyCreator() {
        return super.defaultAdvisorAutoProxyCreator();
    }

    @Bean
    protected AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor(SecurityManager securityManager) {
        return super.authorizationAttributeSourceAdvisor(securityManager);
    }

}

本身沒有什麼原始碼，主要看下父類。

AbstractShiroAnnotationProcessorConfiguration

public class AbstractShiroAnnotationProcessorConfiguration {

    protected DefaultAdvisorAutoProxyCreator defaultAdvisorAutoProxyCreator() {
        return new DefaultAdvisorAutoProxyCreator();
    }

    protected AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor(SecurityManager securityManager) {
        AuthorizationAttributeSourceAdvisor advisor = new AuthorizationAttributeSourceAdvisor();
        advisor.setSecurityManager(securityManager);
        return advisor;
    }

}

DefaultAdvisorAutoProxyCreator 是 spring 中的自動代理實現類，此處不做展開。

我們重點看一下 AuthorizationAttributeSourceAdvisor 物件：

AuthorizationAttributeSourceAdvisor

這裡主要做了兩件事：

（1）設定對應的 securityManager

（2）處理有 RequiresPermissions 等 shiro 的內建註解的方法。

@SuppressWarnings({"unchecked"})
public class AuthorizationAttributeSourceAdvisor extends StaticMethodMatcherPointcutAdvisor {

    private static final Logger log = LoggerFactory.getLogger(AuthorizationAttributeSourceAdvisor.class);

    private static final Class<? extends Annotation>[] AUTHZ_ANNOTATION_CLASSES =
            new Class[] {
                    RequiresPermissions.class, RequiresRoles.class,
                    RequiresUser.class, RequiresGuest.class, RequiresAuthentication.class
            };

    protected SecurityManager securityManager = null;

    /**
     * Create a new AuthorizationAttributeSourceAdvisor.
     */
    public AuthorizationAttributeSourceAdvisor() {
        setAdvice(new AopAllianceAnnotationsAuthorizingMethodInterceptor());
    }

    public SecurityManager getSecurityManager() {
        return securityManager;
    }

    public void setSecurityManager(org.apache.shiro.mgt.SecurityManager securityManager) {
        this.securityManager = securityManager;
    }

}

AopAllianceAnnotationsAuthorizingMethodInterceptor

這個名字起的，好傢伙，真長。

這裡就是對於註解的響應方法 aop 攔截器實現。

package org.apache.shiro.spring.security.interceptor;

import org.aopalliance.intercept.MethodInterceptor;
import org.aopalliance.intercept.MethodInvocation;
import org.apache.shiro.aop.AnnotationResolver;
import org.apache.shiro.authz.aop.*;
import org.apache.shiro.spring.aop.SpringAnnotationResolver;

import java.lang.reflect.Method;
import java.util.ArrayList;
import java.util.List;

/**
 * Allows Shiro Annotations to work in any <a href="http://aopalliance.sourceforge.net/">AOP Alliance</a>
 * specific implementation environment (for example, Spring).
 *
 * @since 0.2
 */
public class AopAllianceAnnotationsAuthorizingMethodInterceptor
        extends AnnotationsAuthorizingMethodInterceptor implements MethodInterceptor {

    public AopAllianceAnnotationsAuthorizingMethodInterceptor() {
        List<AuthorizingAnnotationMethodInterceptor> interceptors =
                new ArrayList<AuthorizingAnnotationMethodInterceptor>(5);

        //use a Spring-specific Annotation resolver - Spring's AnnotationUtils is nicer than the
        //raw JDK resolution process.
        AnnotationResolver resolver = new SpringAnnotationResolver();
        //we can re-use the same resolver instance - it does not retain state:
        interceptors.add(new RoleAnnotationMethodInterceptor(resolver));
        interceptors.add(new PermissionAnnotationMethodInterceptor(resolver));
        interceptors.add(new AuthenticatedAnnotationMethodInterceptor(resolver));
        interceptors.add(new UserAnnotationMethodInterceptor(resolver));
        interceptors.add(new GuestAnnotationMethodInterceptor(resolver));

        setMethodInterceptors(interceptors);
    }
    
    //省略 invoke 部分
}

到這裡實際上就比較簡單了，相信聰明如你一定已經知道整個 spring-shiro 面紗背後的秘密了。

我們直接看一下 PermissionAnnotationMethodInterceptor 的實現。

PermissionAnnotationMethodInterceptor

import org.apache.shiro.aop.AnnotationResolver;

public class PermissionAnnotationMethodInterceptor extends AuthorizingAnnotationMethodInterceptor {

    public PermissionAnnotationMethodInterceptor() {
        super( new PermissionAnnotationHandler() );
    }

    /**
     * @param resolver
     * @since 1.1
     */
    public PermissionAnnotationMethodInterceptor(AnnotationResolver resolver) {
        super( new PermissionAnnotationHandler(), resolver);
    }
}

處理類實現如下：

package org.apache.shiro.authz.aop;

import org.apache.shiro.authz.AuthorizationException;
import org.apache.shiro.authz.annotation.Logical;
import org.apache.shiro.authz.annotation.RequiresPermissions;
import org.apache.shiro.authz.annotation.RequiresRoles;
import org.apache.shiro.subject.Subject;

import java.lang.annotation.Annotation;


public class PermissionAnnotationHandler extends AuthorizingAnnotationHandler {

    public PermissionAnnotationHandler() {
        super(RequiresPermissions.class);
    }

    
    // 獲取對應的註解值
    protected String[] getAnnotationValue(Annotation a) {
        RequiresPermissions rpAnnotation = (RequiresPermissions) a;
        return rpAnnotation.value();
    }

    // 校驗當前主題，是否擁有對應的許可權。
    public void assertAuthorized(Annotation a) throws AuthorizationException {
        if (!(a instanceof RequiresPermissions)) return;

        RequiresPermissions rpAnnotation = (RequiresPermissions) a;
        String[] perms = getAnnotationValue(a);
        Subject subject = getSubject();

        if (perms.length == 1) {
            subject.checkPermission(perms[0]);
            return;
        }
        if (Logical.AND.equals(rpAnnotation.logical())) {
            getSubject().checkPermissions(perms);
            return;
        }
        if (Logical.OR.equals(rpAnnotation.logical())) {
            // Avoid processing exceptions unnecessarily - "delay" throwing the exception by calling hasRole first
            boolean hasAtLeastOnePermission = false;
            for (String permission : perms) if (getSubject().isPermitted(permission)) hasAtLeastOnePermission = true;
            // Cause the exception if none of the role match, note that the exception message will be a bit misleading
            if (!hasAtLeastOnePermission) getSubject().checkPermission(perms[0]);
            
        }
    }
}

小結

這一節我們講解了如何整合 spring 與 shiro，下一節我們將實戰整合 springboot 與 shiro，感興趣的小夥伴可以關注一波不迷路。

為了便於大家學習，所有原始碼都已開源：

https://gitee.com/houbinbin/shiro-inaction/tree/master/shiro-inaction-02-springalone

希望本文對你有所幫助，如果喜歡，歡迎點贊收藏轉發一波。

我是老馬，期待與你的下次相遇。

參考資料

10 Minute Tutorial on Apache Shiro

https://shiro.apache.org/reference.html

https://shiro.apache.org/session-management.html

本文由部落格一文多發平臺 OpenWrite 釋出！