Spring Boot+Shiro+JWT实现多Realm时Filter异常捕捉

近日，大叔接公司需求，搭建前后端分离的后台管理模块接口。
简述登陆模块相关需求：

用户输入用户名和密码获取JWTToken令牌
用户使用JWTToken令牌访问后端业务接口

大叔简单说下Springboot集成Shiro的过程：
1.在pom.xml引入Shiro

<!-- Shiro使用Srping框架 -->
<dependency>
    <groupId>org.apache.shiro</groupId>
    <artifactId>shiro-spring</artifactId>
</dependency>

2.写自己的Realm：UserRealm.java，JWTRealm.java，

/**
*   因为UserRealm只用于登陆验证故继承AuthenticatingRealm就好了
**/
public class UserRealm extends AuthenticatingRealm {
     /**
     *  该方法用于多Realm认证时识别需要使用哪一个Realm
     */ 
    @Override
    public boolean supports(AuthenticationToken token) {
        return token instanceof UsernamePasswordToken;
    } 
    /**
    *   该方法用于登陆身份验证
    **/
    @Override
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
        //TODO  根据自己的验证需要写登陆验证
     }
}

/**
*   JWTRealm既要验证身份，又要做权限认证，所以继承AuthorizingRealm 
**/
public class JWTRealm extends AuthorizingRealm {
    /**
    *   该方法用于多Realm认证时识别需要使用哪一个Realm
    **/
    @Override
    public boolean supports(AuthenticationToken token) {
        return token instanceof JwtToken;
    }
    
    /**
    *   权限 权限验证时会执行到这里
    **/ 
    @Override
    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {
        //TODO 根据自己的设计写权限
    }
    /**
    *   该方法用于JWTToken验证
    **/
    @Override
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken auth) throws AuthenticationException {
        //TODO  根据自己的验证需要写验证
    }
}

3.写JWTFilter.java

public class JwtFilter extends BasicHttpAuthenticationFilter {
    @Override
    protected boolean isAccessAllowed(ServletRequest request, ServletResponse response, Object mappedValue) {
        //TODO
        return true;
    }
    
    @Override
    protected boolean onAccessDenied(ServletRequest request, ServletResponse response) throws Exception {
        //TODO 
        return false;
    }
    
}

4.写ShiroConfig.java

/**
*   加载权限配置
**/
@Configuration
public class ShiroConfig {
    /**
     * 注册shiro的Filter，拦截请求
     */
    @Bean
    public FilterRegistrationBean<Filter> filterRegistrationBean(DefaultWebSecurityManager securityManager)
            throws Exception {
        FilterRegistrationBean<Filter> filterRegistration = new FilterRegistrationBean<Filter>();
        filterRegistration.setFilter((Filter) shiroFilter(securityManager).getObject());
        filterRegistration.addInitParameter("targetFilterLifecycle", "true");
        filterRegistration.setAsyncSupported(true);
        filterRegistration.setEnabled(true);
        filterRegistration.setDispatcherTypes(DispatcherType.REQUEST);
        return filterRegistration;
    }

    @Bean
    public DefaultWebSecurityManager securityManager() {
        DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager();
        // 设置realm,这里不设置的话会报错
        // One or more realms must be present to execute an authentication attempt. One
        // or more realms must be present to execute an authentication attempt.
        securityManager.setAuthenticator(authenticator());
        securityManager.setAuthorizer(authorizer());
        return securityManager;
    }
    
    /**
    * 用于用户名密码登录时认证的realm
    */
    @Bean("userRealm")
    public Realm userRealm() {
        UserRealm userRealm = new UserRealm();
        return userRealm;
    }

    /**
    * 用于JWT token认证的realm
    */
    @Bean("jwtRealm")
    public Realm jwtRealm() {
        JWTRealm jwtRealm= new JWTRealm();
        return jwtRealm;
    }
     /**
     * 初始化Authenticator 认证器 身份认证
     */
    @Bean
    public Authenticator authenticator() {
        ModularRealmAuthenticator authenticator = new ModularRealmAuthenticator();//留意这一行哟
        // 设置两个Realm，一个用于用户登录验证；一个用于jwt token的认证和访问权限获取
        authenticator.setRealms(Arrays.asList(jwtRealm(), userRealm()));
        // 设置多个realm认证策略，一个成功即跳过其它的
        authenticator.setAuthenticationStrategy(new FirstSuccessfulStrategy());
        return authenticator;
    }
    
    /**
     * 初始化authorizer 认证器 权限认证
     * @return
     */
    @Bean
    public Authorizer authorizer() {
        ModularRealmAuthorizer authorizer = new ModularRealmAuthorizer();//这里的
        authorizer.setRealms(Arrays.asList(jwtShiroRealm()));
        return authorizer;
    }
    
    /**
    * 禁用session, 不保存用户登录状态。保证每次请求都重新认证。
    * 需要注意的是，如果用户代码里调用Subject.getSession()还是可以用session，如果要完全禁用，要配合下面的noSessionCreation的Filter来实现
    */
    @Bean
    protected SessionStorageEvaluator sessionStorageEvaluator() {
        DefaultWebSessionStorageEvaluator sessionStorageEvaluator = new DefaultWebSessionStorageEvaluator();
        sessionStorageEvaluator.setSessionStorageEnabled(false);
        return sessionStorageEvaluator;
    }
    
    /**
     * 设置过滤器，将自定义的Filter加入
     */
    @Bean("shiroFilter")
    public ShiroFilterFactoryBean shiroFilter(DefaultWebSecurityManager securityManager) {
        ShiroFilterFactoryBean factoryBean = new ShiroFilterFactoryBean();
        factoryBean.setSecurityManager(securityManager);
        // 添加过滤器
        Map<String, Filter> filterMap = new HashMap<String, Filter>();
        // JWT过滤器
        filterMap.put("jwtFilter", jwtFilter());// JwTfilter
        factoryBean.setFilters(filterMap);
        // 拦截器
        factoryBean.setFilterChainDefinitionMap(shiroFilterChainDefinition().getFilterChainMap()); 
        return factoryBean;
    }

    @Bean
    protected ShiroFilterChainDefinition shiroFilterChainDefinition() {
        DefaultShiroFilterChainDefinition chainDefinition = new DefaultShiroFilterChainDefinition(); 
        chainDefinition.addPathDefinition("/login", "noSessionCreation,anon"); // login不做认证，noSessionCreation的作用是用户在操作session时会抛异常
        chainDefinition.addPathDefinition("/**", "noSessionCreation,jwtFilter"); // 默认进行用户鉴权
        return chainDefinition;
    }

    // 不要加@Bean注解，不然spring会自动注册成filter，我们这里是手动注入
    protected JwtFilter jwtFilter() {
        return new JwtFilter();
    }
    /**
    * 开启Shiro注解通知器
    */
    @Bean
    public AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor(
            @Qualifier("securityManager") SecurityManager securityManager) {
        AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor = new AuthorizationAttributeSourceAdvisor();
        authorizationAttributeSourceAdvisor.setSecurityManager(securityManager);
        return authorizationAttributeSourceAdvisor;
    }

    @Bean
    public DefaultAdvisorAutoProxyCreator advisorAutoProxyCreator() {
        DefaultAdvisorAutoProxyCreator creator = new DefaultAdvisorAutoProxyCreator();
        creator.setProxyTargetClass(true);
        return creator;
    }
}

好了，到这里我们可以算作是完成了Shiro的集成工作了

随便写一段测试代码

@RestController
public class TestController {
    @GetMapping("/helloWorld")
    @RequiresPermissions("system:test:hello")
    public String helloWorld() {
        return “hello world";
    }
}

启动项目，请求这个接口试试看吧。

在实现了多Realm的登陆之后，发现当JWTRealm身份验证报错时，在JWTFilter获取到的异常类型都是AuthenticationException，而导致不能再JWTRealm中根据不同的异常做不同的处理。
怎么办呢?跟踪异常抛出流程发现多Realm时，异常在ModularRealmAuthenticator中会被处理掉，统一抛出AuthenticationException。所以大叔发现重写ModularRealmAuthenticator中的doMultiRealmAuthentication方法就好了

public class MultiRealmAuthenticator extends ModularRealmAuthenticator {
    private static final Logger log = LoggerFactory.getLogger(MultiRealmAuthenticator.class);
    @Override
    protected AuthenticationInfo doMultiRealmAuthentication(Collection<Realm> realms, AuthenticationToken token)
            throws AuthenticationException {
        AuthenticationStrategy strategy = getAuthenticationStrategy();
        AuthenticationInfo aggregate = strategy.beforeAllAttempts(realms, token);
        if (log.isTraceEnabled()) {
            log.trace("Iterating through {} realms for PAM authentication", realms.size());
        }
        AuthenticationException authenticationException = null;
        for (Realm realm : realms) {
            aggregate = strategy.beforeAttempt(realm, token, aggregate);
            if (realm.supports(token)) {
                log.trace("Attempting to authenticate token [{}] using realm [{}]", token, realm);
                AuthenticationInfo info = null;
                try {
                    info = realm.getAuthenticationInfo(token);
                } catch (AuthenticationException e) {
                    authenticationException = e;
                    if (log.isDebugEnabled()) {
                        String msg = "Realm [" + realm
                                + "] threw an exception during a multi-realm authentication attempt:";
                        log.debug(msg, e);
                    }
                }
                aggregate = strategy.afterAttempt(realm, token, info, aggregate, authenticationException);
            } else {
                log.debug("Realm [{}] does not support token {}.  Skipping realm.", realm, token);
            }
        }
        if (authenticationException != null) {
            throw authenticationException;
        }
        aggregate = strategy.afterAllAttempts(token, aggregate);
        return aggregate;
    }
}

重写之后替换掉ShiroConfig.java中的身份认证就好了

        /**
     * 初始化Authenticator 认证器 身份认证
     */
    @Bean
    public Authenticator authenticator() {
        MultiRealmAuthenticator authenticator = new MultiRealmAuthenticator();
        // 设置两个Realm，一个用于用户登录验证和访问权限获取；一个用于jwt token的认证
        authenticator.setRealms(Arrays.asList(jwtShiroRealm(), dbShiroRealm()));
        // 设置多个realm认证策略，一个成功即跳过其它的
        authenticator.setAuthenticationStrategy(new FirstSuccessfulStrategy());
        return authenticator;
    }

大叔说，坑再多，不在怕，爬起来，反正还会掉坑里的