我正在构建自己的
AuthorizingRealm
子类,并且很难将其连接到我的 SecurityManager
。
我的境界本质:
public class MyRealm extends AuthorizingRealm {
protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
try {
// My custom logic here
} catch(Throwable t) {
System.out.println(t.getMessage());
}
SimpleAuthenticationInfo authn = new SimpleAuthenticationInfo(new MyUser(), "somePassword");
return authn;
}
protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {
try {
// My custom logic here
} catch(Throwable t) {
System.out.println(t.getMessage());
}
return new SimpleAuthorizationInfo();
}
}
然后在我的“shiro.ini”中:
# =======================
# Shiro INI configuration
# =======================
[main]
myRealm = com.me.myapp.security.MyRealm
然后在我的驱动程序类/主方法(我用于测试的)中:
public class Driver {
public static void main(String[] args) {
Driver d = new Driver();
d.test();
}
public void test() {
Factory<SecurityManager> factory = new IniSecurityManagerFactory("classpath:shiro.ini");
SecurityManager securityManager = factory.getInstance();
SecurityUtils.setSecurityManager(securityManager);
UsernamePasswordToken token = new UsernamePasswordToken("", "");
token.setRememberMe(true);
System.out.println("Shiro props:");
System.out.println(securityManager.getProperties());
Subject currentUser = SecurityUtils.getSubject()
try {
currentUser.login(token)
println "I think this worked!"
} catch (UnknownAccountException uae) {
println "Exception: ${uae}"
} catch (IncorrectCredentialsException ice) {
println "Exception: ${ice}"
} catch (LockedAccountException lae) {
println "Exception: ${lae}"
} catch (ExcessiveAttemptsException eae) {
println "Exception: ${eae}"
} catch (AuthenticationException ae) {
println "Exception: ${ae}"
}
}
}
当我运行这个时,我得到:
Shiro props:
[class:class org.apache.shiro.mgt.DefaultSecurityManager, cacheManager:null, subjectFactory:org.apache.shiro.mgt.DefaultSubjectFactory@6a2b8b42, authorizer:org.apache.shiro.authz.ModularRealmAuthorizer@50c3d082, realms:[com.me.myapp.security.MyRealm@67ae303a], subjectDAO:org.apache.shiro.mgt.DefaultSubjectDAO@5ce06503, rememberMeManager:null, authenticator:org.apache.shiro.authc.pam.ModularRealmAuthenticator@1007d798, sessionManager:org.apache.shiro.session.mgt.DefaultSessionManager@72db4460]
Exception: org.apache.shiro.authc.AuthenticationException: Authentication failed for token submission [org.apache.shiro.authc.UsernamePasswordToken - , rememberMe=true]. Possible unexpected error? (Typical or expected login exceptions should extend from AuthenticationException).
所以它看起来像是在读取我的 shiro.ini,因为它选择了正确的领域,但是
MyRealm
除了删除应该进行身份验证的虚拟用户(无论提供的用户名/密码如何)之外不执行任何操作。关于我哪里出了问题有什么想法吗?
将其添加到您的 shiro.ini 中:
securityManager.realms = $myRealm
UsernamePasswordToken token = new UsernamePasswordToken("", "somePassword");
而不是空密码。
我认为这有效!
我自己没有这样做过,但您可以尝试以下几件事:
如果不需要授权逻辑,请考虑子类化 AuthenticatingRealm 而不是 AuthorizingRealm
在方法 doGetAuthenticationInfo 中,考虑使用以下代码:
SimpleAuthenticationInfo authn = new SimpleAuthenticationInfo(token.getPrincipal(), token.getCredentials(), "myRealm");
您似乎已经正确创建了一个领域,但没有告诉
SecurityManager
它是要使用的领域之一。这样,它只是在 main
的 shiro.ini
部分创建的另一个对象。
要告诉 Shiro 的
SecurityManager
它需要使用 myRealm
作为 Realm,您需要将其添加到您的 shiro.ini
中:
securityManager.realms = $myRealm