我们先从一段最基础的代码开始

@Test
    public void testHelloWorld(){
        // 获取SecurityManager工厂，此处使用ini配置文件初始化SecurityManager
        IniSecurityManagerFactory managerFactory = new IniSecurityManagerFactory
                ("classpath:shiro.ini");
        // 得到SecurityManager实例 并绑定给SecurityUtils
        SecurityManager manager = managerFactory.getInstance();
        SecurityUtils.setSecurityManager(manager);
        // 得到Subject及创建用户名/密码身份验证Token（即用户身份/凭证）
        Subject subject = SecurityUtils.getSubject();
        UsernamePasswordToken token = new UsernamePasswordToken("zhang","123".toCharArray(),true);

        try {
            subject.login(token);
        } catch (AuthenticationException e) {
            // 身份验证失败
            e.printStackTrace();
        }

        // 断言 登录是否成功
        Assert.assertEquals(true,subject.isAuthenticated());

        Session session = subject.getSession();
        System.out.println(session.getId());
        System.out.println(subject.getPrincipal());// zhang
        // 设置属性
        session.setAttribute("name",subject.getPrincipal());
        // 获取属性
        session.getAttribute("name");
        Collection<Object> attributeKeys = session.getAttributeKeys();

        Iterator<Object> iterator = attributeKeys.iterator();
        while (iterator.hasNext()){
            System.out.println("所有的属性KEY ："+iterator.next());
        }

        // 退出
        subject.logout();

    }

这里我们可以不用关心SecurityManager到底是怎么创建的，反正就是加载配置文件。

跟踪代码

SecurityUtils.setSecurityManager(manager);

public abstract class SecurityUtils {
    
    private static SecurityManager securityManager;

    public SecurityUtils() {
    }
    public static void setSecurityManager(SecurityManager securityManager) {
        SecurityUtils.securityManager = securityManager;
    }

SecurityUtils.getSubject();

public abstract class SecurityUtils {
    public static Subject getSubject() {
        // 第一步：
        // 注意这里的ThreadContext是个什么鬼
        Subject subject = ThreadContext.getSubject();
        if(subject == null) {
            // 第二步：
            subject = (new Builder()).buildSubject();
            ThreadContext.bind(subject);
        }
        return subject;
     }

第一步：
        // 注意这里的ThreadContext是个什么鬼
       Subject subject = ThreadContext.getSubject();

public abstract class ThreadContext {
     private static final Logger log = LoggerFactory.getLogger(ThreadContext.class);
    public static final String SECURITY_MANAGER_KEY = 
                                ThreadContext.class.getName() + "_SECURITY_MANAGER_KEY";
    public static final String SUBJECT_KEY = 
                                  ThreadContext.class.getName() + "_SUBJECT_KEY";
    // 注意这个变量，ThreadLocal是当前线程用来保存信息的，每个线程都有一个ThreadLocal，
      //多线程环境下只能各自取各自ThreadLocal中保存的信息
    private static final ThreadLocal<Map<Object, Object>> resources = 
                                      new ThreadContext.InheritableThreadLocalMap();

    public static Subject getSubject() {
        return (Subject)get(SUBJECT_KEY);
    }

    private static Object getValue(Object key) {
        return ((Map)resources.get()).get(key);
    }

    public static Object get(Object key) {
        if(log.isTraceEnabled()) {
            String value = "get() - in thread [" + Thread.currentThread().getName() + "]";
            log.trace(value);
        }

        Object value1 = getValue(key);
        if(value1 != null && log.isTraceEnabled()) {
            String msg = "Retrieved value of type [" + value1.getClass().getName() + "] for key [" + key + "] " + "bound to thread [" + Thread.currentThread().getName() + "]";
            log.trace(msg);
        }

        return value1;
    }

       可以看到，ThreadContext.getSubject();最终调用的是getValue()方法，然后从ThreadLocal中取出Subject。那ThreadLocal中的Subject怎么来的呢？看第二步。

第二步：
(new Builder()).buildSubject()

public interface Subject {
    xxxx省略其他代码，重点是Subject里面有一个静态的Builder类
    public static class Builder {
        private final SubjectContext subjectContext;
        private final SecurityManager securityManager;

        public Builder() {
            this(SecurityUtils.getSecurityManager());
        }

    public Subject buildSubject() {
            return this.securityManager.createSubject(this.subjectContext);
    }

来看看buildSubject干了啥：

public interface SecurityManager extends Authenticator, Authorizer, SessionManager {
    Subject login(Subject var1, AuthenticationToken var2) throws AuthenticationException;

    void logout(Subject var1);

    Subject createSubject(SubjectContext var1);
}

它是一个接口，我们找一个实现类，就找DefaultSecurityManager看看吧

public class DefaultSecurityManager extends SessionsSecurityManager {
    private static final Logger log = LoggerFactory.getLogger(DefaultSecurityManager.class);
    protected RememberMeManager rememberMeManager;
    protected SubjectDAO subjectDAO;
    protected SubjectFactory subjectFactory;

  protected Subject createSubject(AuthenticationToken token, AuthenticationInfo info, Subject existing) {
        // 这里的token是我们之前写的UsernamePasswordToken
        SubjectContext context = this.createSubjectContext();
        context.setAuthenticated(true);
        context.setAuthenticationToken(token);
        context.setAuthenticationInfo(info);
        if(existing != null) {
            context.setSubject(existing);
        }

        return this.createSubject(context);
    }

这里都是在组装必要的参数，我们直接看最后一句：

public Subject createSubject(SubjectContext subjectContext) {
        SubjectContext context = this.copy(subjectContext);
        context = this.ensureSecurityManager(context);
        context = this.resolveSession(context);
        context = this.resolvePrincipals(context);
        Subject subject = this.doCreateSubject(context);
        this.save(subject);
        return subject;
    }

注意其中的两个方法：doCreateSubject(context)和save(subject)
先来看创建的：

protected Subject doCreateSubject(SubjectContext context) {
        return this.getSubjectFactory().createSubject(context);
    }

// 使用工厂类创建Subject
public class DefaultSubjectFactory implements SubjectFactory {
    public DefaultSubjectFactory() {
    }

    public Subject createSubject(SubjectContext context) {
        SecurityManager securityManager = context.resolveSecurityManager();
        Session session = context.resolveSession();
        boolean sessionCreationEnabled = context.isSessionCreationEnabled();
        PrincipalCollection principals = context.resolvePrincipals();
        boolean authenticated = context.resolveAuthenticated();
        String host = context.resolveHost();
        return new DelegatingSubject(principals, authenticated, host, session, sessionCreationEnabled, securityManager);
    }

// 注意这里有个SecurityManager，这个就是SecurityUtils中的那个静态变量
public class DelegatingSubject implements Subject {
  public DelegatingSubject(PrincipalCollection principals, boolean authenticated, String host, Session session, boolean sessionCreationEnabled, SecurityManager securityManager) {
        if(securityManager == null) {
            throw new IllegalArgumentException("SecurityManager argument cannot be null.");
        } else {
            this.securityManager = securityManager;
            this.principals = principals;
            this.authenticated = authenticated;
            this.host = host;
            if(session != null) {
                this.session = this.decorate(session);
            }

            this.sessionCreationEnabled = sessionCreationEnabled;
        }
    }

再看save(subject)方法，它是怎么保存的，其实应该也能想到了，肯定是用ThreadLocal来保存的，我们来看看：先回到DefaultSecurityManager

protected void save(Subject subject) {
        this.subjectDAO.save(subject);
    }

public interface SubjectDAO {
    Subject save(Subject var1);
    void delete(Subject var1);
}

找个SubjectDAO的实现类：

public class DefaultSubjectDAO implements SubjectDAO {
    public Subject save(Subject subject) {
        if(this.isSessionStorageEnabled(subject)) {
            this.saveToSession(subject);
        } else {
            log.trace("Session storage of subject state for Subject [{}] has been disabled: identity and authentication state are expected to be initialized on every request or invocation.", subject);
        }

        return subject;
    }
public Subject save(Subject subject) {
        if(this.isSessionStorageEnabled(subject)) {
            this.saveToSession(subject);
        } else {
            log.trace("Session storage of subject state for Subject [{}] has been disabled: identity and authentication state are expected to be initialized on every request or invocation.", subject);
        }

        return subject;
    }

    protected void saveToSession(Subject subject) {
        this.mergePrincipals(subject);// 保存principals信息
        this.mergeAuthenticationState(subject);// 保存验证的状态
    }

咦，咋跟我想象的不一样呢？
原因是我忽略了SecurityUtils.getSubject();中还有重要的一步，ThreadContext.bind(subject);这才是我之前设想那样。进入这个方法来看看：

public abstract class ThreadContext {
    private static final Logger log = LoggerFactory.getLogger(ThreadContext.class);
    public static final String SECURITY_MANAGER_KEY = ThreadContext.class.getName() + "_SECURITY_MANAGER_KEY";
    public static final String SUBJECT_KEY = ThreadContext.class.getName() + "_SUBJECT_KEY";
    private static final ThreadLocal<Map<Object, Object>> resources = new ThreadContext.InheritableThreadLocalMap();

    public static void bind(Subject subject) {
        if(subject != null) {
            put(SUBJECT_KEY, subject);
        }
    }

    public static void put(Object key, Object value) {
        if(key == null) {
            throw new IllegalArgumentException("key cannot be null");
        } else if(value == null) {
            remove(key);
        } else {
            ((Map)resources.get()).put(key, value);
            if(log.isTraceEnabled()) {
                String msg = "Bound value of type [" + value.getClass().getName() + "] for key [" + key + "] to thread " + "[" + Thread.currentThread().getName() + "]";
                log.trace(msg);
            }

        }
    }

看到put(Object key, Object value)方法中的((Map)resources.get()).put(key, value);你还想不到这是个什么操作吗。

subject.login(token);

public void login(AuthenticationToken token) throws AuthenticationException {
        this.clearRunAsIdentitiesInternal();
        Subject subject = this.securityManager.login(this, token);
}

public class DefaultSecurityManager extends SessionsSecurityManager {
  public Subject login(Subject subject, AuthenticationToken token) throws AuthenticationException {
        AuthenticationInfo info;
        try {
            info = this.authenticate(token);
        } catch (AuthenticationException var7) {
            AuthenticationException loggedIn = var7;

            try {
                this.onFailedLogin(token, loggedIn, subject);
            } catch (Exception var6) {
                if(log.isInfoEnabled()) {
                    log.info("onFailedLogin method threw an exception.  Logging and propagating original AuthenticationException.", var6);
                }
            }

            throw var7;
        }

        Subject loggedIn1 = this.createSubject(token, info, subject);
        this.onSuccessfulLogin(token, info, loggedIn1);
        return loggedIn1;
    }

登录就是将Subject交给SecurityManager去一步步的验证，然后根据配置保存需要保存的信息。

总结：1、理解Subject，SecurityManager之间的关系
                       一个SecurityManager可以管理多个Subject，且能在多线程下良好使用
            2、ThreadLocal的使用