Java:Shiro的架构学习笔记

张开涛的第一章 Shiro简介——《跟我学Shiro》,其实是解读了一下 Shiro的架构 这篇文章,本着寻根究底的态度,我再一次去阅读这篇文章。为什么说是再一次呢?因为之前读过好几次了,不过就是没有完全理解明白,自己也说不好卡在哪里了,包括张开涛的文章,我也读过两遍了,这次第三遍读,一下子豁然开朗,然后不明白之前为啥就没读明白。

正文

3个主要的概念: Subject , SecurityManagerRealms

Java:Shiro的架构学习笔记

Subject 可以是一个用户,但不仅仅可以代表一个用户,所有对这个系统的外部请求的主体都可以看成是一个 Subject ,例如一个 service ,这里是做了一个抽象概括的设计,这个我能理解,如果你理解不了的话,那说明你还没有接触过相关的业务,例如 SSO ,那就先把它理解成一个用户,也没有关系。将来总有一天,你会明白,会回来和我一起唱这首《当当当》。

SecurityManager Shiro设计的核心的逻辑都在这里面,但是,我们应该可以先不理会它是怎么工作的,先把它当做一个黑匣子,它有它自己运行的逻辑。

Realms 这个单词的意思是领域,范围。原文这么说:

Realms act as the ‘bridge’ or ‘connector’ between Shiro and your application’s security data. When it comes time to actually interact with security-related data like user accounts to perform authentication (login) and authorization (access control), Shiro looks up many of these things from one or more Realms configured for an application.
In this sense a Realm is essentially a security-specific DAO: it encapsulates connection details for data sources and makes the associated data available to Shiro as needed. When configuring Shiro, you must specify at least one Realm to use for authentication and/or authorization. The SecurityManager may be configured with multiple Realms, but at least one is required.

就是说和安全相关数据security-specific )打交道的是这个对象,有关认证、授权都是通过它来打交道,或者说,通过不同的realm来和相关的“机构”(打个比方)打交道,每个机构有自己的 realm ,再或者说, realm 可以理解成 DAO ,去访问相关的数据。

更具体的分析:

Java:Shiro的架构学习笔记

Subject:A security-specific ‘view’ of the entity (user, 3rd-party service, cron job, etc) currently interacting with the software.

一个实体的安全相关的 view –这个概念还需要好好理解一下,怎么被称为一个 view 呢?

SecurityManager又分为了一些子模块:

Authenticator (org.apache.shiro.authc.Authenticator) The Authenticator is the component that is responsible for executing and reacting to authentication (log-in) attempts by users. When a user tries to log-in, that logic is executed by the Authenticator. The Authenticator knows how to coordinate with one or more Realms that store relevant user/account information. The data obtained from these Realms is used to verify the user’s identity to guarantee the user really is who they say they are.   Authentication Strategy (org.apache.shiro.authc.pam.AuthenticationStrategy) If more than one Realm is configured, the AuthenticationStrategy will coordinate the Realms to determine the conditions under which an authentication attempt succeeds or fails (for example, if one realm succeeds but others fail, is the attempt successful? Must all realms succeed? Only the first?).

Authenticator:认证器,用来负责用户登录认证,它对应着一个或者多个 Realm

Authentication Strategy:认证策略,如果多个 Realm配置,那么 Authentication Strategy 来负责协调这些 Realm 产生矛盾的时候,该如何处理,例如一个 realm 成功,而其它的失败了,改怎么办,等等。在这一点上,张开涛的文章解释的不是太准确。

Authrizer:授权器,负责确认用户的访问权限。

SessionManager (org.apache.shiro.session.mgt.SessionManager) The SessionManager knows how to create and manage user Session lifecycles to provide a robust Session experience for users in all environments. This is a unique feature in the world of security frameworks - Shiro has the ability to natively manage user Sessions in any environment, even if there is no Web/Servlet or EJB container available. By default, Shiro will use an existing session mechanism if available, (e.g. Servlet Container), but if there isn’t one, such as in a standalone application or non-web environment, it will use its built-in enterprise session management to offer the same programming experience. The SessionDAO exists to allow any datasource to be used to persist sessions.   SessionDAO (org.apache.shiro.session.mgt.eis.SessionDAO) The SessionDAO performs Session persistence (CRUD) operations on behalf of the SessionManager. This allows any data store to be plugged in to the Session Management infrastructure.

SessionManagersession 管理器, Shiro 没有完全依赖 HTTPsession ,而是设计了一个独立的 session

SessionDAOsessionDAO ,用来处理session数据的保存。

CacheManager缓存管理器。

Cryptography加密模块。

Realms: 上面介绍过。

SecurityManager

这个是核心,需要反复理解的是这个,下面又用了一些篇幅来介绍这个,不过在没有完全实践之前,总还是不明白,所以就先不总结了。

总结

又阅读了一遍架构这篇文章,结合着张开涛的文章,感觉明白了不少,现在感觉 Shiro 还是挺简单的,有个两三天应该就大体理解了,不明白当时怎么就堵住了,陷入了思维的死胡同。

原文 

https://www.oxysun.cn/java/java-shiro-note.html

本站部分文章源于互联网,本着传播知识、有益学习和研究的目的进行的转载,为网友免费提供。如有著作权人或出版方提出异议,本站将立即删除。如果您对文章转载有任何疑问请告之我们,以便我们及时纠正。

PS:推荐一个微信公众号: askHarries 或者qq群:474807195,里面会分享一些资深架构师录制的视频录像:有Spring,MyBatis,Netty源码分析,高并发、高性能、分布式、微服务架构的原理,JVM性能优化这些成为架构师必备的知识体系。还能领取免费的学习资源,目前受益良多

转载请注明原文出处:Harries Blog™ » Java:Shiro的架构学习笔记

赞 (0)
分享到:更多 ()

评论 0

  • 昵称 (必填)
  • 邮箱 (必填)
  • 网址