ssm框架下,controller接收到登录请求交给Service并开始处理流程：
1.Service的login方法：
@Service
public class SysUserServiceImpl implements SysUserService {
@Autowired
SysUserMapper mapper;
@Override
public LoginResult login(SysUser sysUser) {
LoginResult loginResult = new LoginResult();
try {
List<SysUser> sysUsers = mapper.selectByExample(sysUser.getUsername());
BackUserToken backUserToken=new BackUserToken(sysUser.getUsername(), sysUser.getPwd(),sysUsers);
SecurityUtils.getSubject().login(backUserToken);
loginResult.setStatus(RespMSG.STATUS_SUCCESS);
loginResult.setMsg(RespMSG.MSG_SUCCESS);
loginResult.setSysUser(sysUsers.get(0));
return loginResult;
} catch (UnknownAccountException e) {
loginResult.setStatus(RespMSG.STATUS_NON_EXISTENT);
loginResult.setMsg(RespMSG.MSG_NON_EXISTENT);
return loginResult;
} catch (AccountException e) {
e.printStackTrace();
// loginResult.setStatus(RespMSG.);
// loginResult.setMsg(RespMSG.MSG_NON_EXISTENT);
// return loginResult;
} catch (DeadlineException e) {
loginResult.setStatus(RespMSG.STATUS_OVERDUE);
loginResult.setMsg(RespMSG.MSG_OVERDUE);
return loginResult;
} catch (AccountRepeatException e) {
loginResult.setStatus(RespMSG.STATUS_REPETITION);
loginResult.setMsg(RespMSG.MSG_REPETITION);
return loginResult;
} catch (IncorrectCredentialsException e) {
loginResult.setStatus(RespMSG.STATUS_WRONG_PWD);
loginResult.setMsg(RespMSG.MSG_WRONG_PWD);
return loginResult;
}
loginResult.setMsg(RespMSG.MSG_UNKNOW);
loginResult.setStatus(RespMSG.STATUS_UNKNOW);
return loginResult;
}
}
BackUserToken集成了UsernamePasswordToken，主要是构造参数多了一个List<SysUser>.因为我需要在service中将登录用户的详细
信息返回给客户端，同时将登录用户的信息传递给Realm进行登录验证。
关键方法是：
SecurityUtils.getSubject().login(backUserToken);
其具体实现是：
2.DelegatingSubject implements Subject
public class DelegatingSubject implements Subject {
public void login(AuthenticationToken token) throws AuthenticationException {
...
Subject subject = this.securityManager.login(this, token);
...
}
}
token继续传递：
3.DefaultSecurityManager
public class DefaultSecurityManager extends SessionsSecurityManager {
public Subject login(Subject subject, AuthenticationToken token) throws AuthenticationException {
...
info = this.authenticate(token);
...
return loggedIn;
}
}
向下继续
4.AuthenticatingSecurityManager
public abstract class AuthenticatingSecurityManager extends RealmSecurityManager {
public AuthenticationInfo authenticate(AuthenticationToken token) throws AuthenticationException {
return this.authenticator.authenticate(token);
}
}
继续向下
5.AbstractAuthenticator
public abstract class AbstractAuthenticator implements Authenticator, LogoutAware {
public final AuthenticationInfo authenticate(AuthenticationToken token) throws AuthenticationException {
...
info = this.doAuthenticate(token);
...
return info;
}
}
}
6.ModularRealmAuthenticator
public class ModularRealmAuthenticator extends AbstractAuthenticator {
protected AuthenticationInfo doAuthenticate(AuthenticationToken authenticationToken) throws AuthenticationException {
this.assertRealmsConfigured();
Collection<Realm> realms = this.getRealms();
return realms.size() == 1 ? this.doSingleRealmAuthentication((Realm)realms.iterator().next(), authenticationToken) : this.doMultiRealmAuthentication(realms, authenticationToken);
}
}
还是在ModularRealmAuthenticator中
protected AuthenticationInfo doSingleRealmAuthentication(Realm realm, AuthenticationToken token) {
...
AuthenticationInfo info = realm.getAuthenticationInfo(token);
...
}
继续
7.AuthenticatingRealm
public abstract class AuthenticatingRealm extends CachingRealm implements Initializable {
public final AuthenticationInfo getAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
...
info = this.doGetAuthenticationInfo(token);
...
return info;
}
}
然后进入最后一步，在继承了AuthorizingRealm的自定义的realm中进行处理。
8.自定义realm举例
@Override
protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken) {
BackUserToken token = (BackUserToken) authenticationToken;
List<SysUser> sysUsers = token.getUser();
if (sysUsers == null || sysUsers.size() == 0) {
throw new UnknownAccountException();
}
if (sysUsers.size() > 1) {
//用户重复
throw new AccountRepeatException();
}
if (用户已过期) {
if (sysUsers.get(0).getIsAbleDate() == null||sysUsers.get(0).getIsAbleDate().getTime() < new Date().getTime()) {
//用户过期(自定义异常)
throw new DeadlineException();
}
}
SysUser sysUser = sysUsers.get(0);
SimpleAuthenticationInfo authenticationInfo = new SimpleAuthenticationInfo(
sysUser,
sysUser.getPwd(),
getName()
);
return authenticationInfo;
}
