Apache Shiro User's Manual (iv) REALM implementation

In the authentication, authorization internal implementation mechanism is mentioned, the final processing will be handed over to real for processing. Because in Shiro, it is ultimately through realm to get the user, role, and permission information in the application. Typically, the validation information required by Shiro is obtained directly from our data source in realm. It can be said that realm is a DAO that is dedicated to the security framework.

first, the implementation of certification
As mentioned earlier, the Shiro certification process will eventually be handed over to realm, and the realm's Getauthenticationinfo method will be called.
The method mainly performs the following actions:
1. Check the token information submitted for authentication
2. Obtain user information from a data source (typically a database) based on the token information
3. Matching verification of user information
4. Validation by returning a AuthenticationInfo instance that encapsulates the user's information
5, the validation fails to throw Authenticationexception exception information

What we want to do in our application is to customize a realm class, inherit the Authorizingrealm abstract class, Overload dogetauthenticationinfo (), and rewrite the method of getting the user information.
Java code

2. protected AuthenticationInfo dogetauthenticationinfo (Authenticationtoken authctoken) throws Authenticationexception {
4. Usernamepasswordtoken token = (usernamepasswordtoken) Authctoken;
6. User user = Accountmanager.finduserbyusername (token.getusername ());
8.          if   (user != < span class= "keyword" style= "color:rgb (127, 0, 85); Font-weight:bold ">null )  {  
10.              return  new   Simpleauthenticationinfo (User.getusername (),  user.getpassword (),  getname ());   
12. } Else {
14. return null;
16. }
18. }

second, the authorization to achieve
And the authorization implementation is very similar to the authentication implementation, in our custom realm, the overloaded Dogetauthorizationinfo () method, overriding the way to get user permissions.
Java code

2. protected Authorizationinfo Dogetauthorizationinfo (principalcollection principals) {
4. String userName = (string) Principals.fromrealm (GetName ()). Iterator (). Next ();
6. User user = Accountmanager.finduserbyusername (userName);
8. if (user = null) {
10.              simpleauthorizationinfo info = new  simpleauthorizationinfo ();   
12. for (Group group:user.getGroupList ()) {
14. Info.addstringpermissions (Group.getpermissionlist ());
16. }
18. return info;
20. } Else {
22. return null;
24. }
26. }

Source:http://kdboy.iteye.com/blog/1169631

From for notes (Wiz)

Apache Shiro User's Manual (iv) REALM implementation