Shiro Certification Authorization Process _shiro

The advent of the Shiro framework makes authentication and authorization simpler, and the Shiro is like a song for authentication and authorization, the following is a look at the process:

Certification process:

Certification process:

1, through the INI configuration file to create SecurityManager

2, call the Subject.login method to submit the certification, submitted by the token

3, SecurityManager certification, SecurityManager final certification by Modularrealmauthenticator.

4, Modularrealmauthenticator call Inirealm (to realm incoming token) to the INI configuration file to query user information

5, Inirealm According to the input of token (Usernamepasswordtoken) from the Shiro-first.ini query user information, according to the account number of user information (account number and password)

If you are querying the user information, return the user information (account number and password) to Modularrealmauthenticator.

If the query is not there, return null to Modularrealmauthenticator

6, Modularrealmauthenticator receive Inirealm return authentication authentication information

If the authentication information returned is Null,modularrealmauthenticator throw exception (Org.apache.shiro.authc.UnknownAccountException)

If the authentication information returned is not NULL (stating that Inirealm found the user), the Inirealm return user password (existing in the INI file) and the password in token are compared. Throw an exception if inconsistent (Org.apache.shiro.authc.IncorrectCredentialsException)

Authorization process:

1, to subject authorization, call Method ispermitted ("Permission string")

2, SecurityManager execution authorization, through Modularrealmauthorizer execution authorization

3, Modularrealmauthorizer execution Realm (custom customrealm) query permission data from the database

Authorization method to invoke realm: Dogetauthorizationinfo

4, realm from the database query permission data, return Modularrealmauthorizer

5, Modularrealmauthorizer call permissionresolver for permission string alignment

6, if the comparison, ispermitted "permission string" in the realm query to the permission data, indicating that the user access to the permission string has permissions, otherwise do not have permissions, throw an exception.