写完上篇随笔以后(链接).....我也想自己尝试一下写一个Strategy.....Shiro自带了3个Strategy,教程(链接)里作者也给了2个.....我想写个都不一样的策略.....看来看去....决定写个LastSuccessfulStrategy好了...顾名思义就是返回最后一个Realm验证成功的AuthenticationInfo的信息...
1 package com.github.zhangkaitao.shiro.chapter2.authenticator.strategy;
2
3 import org.apache.shiro.authc.AuthenticationException;
4 import org.apache.shiro.authc.AuthenticationInfo;
5 import org.apache.shiro.authc.AuthenticationToken;
6 import org.apache.shiro.authc.pam.AbstractAuthenticationStrategy;
7 import org.apache.shiro.realm.Realm;
8 import org.apache.shiro.util.CollectionUtils;
9
10 public class LastSuccessfulStrategy extends AbstractAuthenticationStrategy {
11 @Override
12 protected AuthenticationInfo merge(AuthenticationInfo info,
13 AuthenticationInfo aggregate) {
14 // TODO Auto-generated method stub
15 if (info != null && !CollectionUtils.isEmpty(info.getPrincipals()))
16 return info;
17 else
18 return aggregate;
19 }
20
21 @Override
22 public AuthenticationInfo afterAttempt(Realm realm,
23 AuthenticationToken token, AuthenticationInfo singleRealmInfo,
24 AuthenticationInfo aggregateInfo, Throwable t)
25 throws AuthenticationException {
26 // TODO Auto-generated method stub
27 return merge(singleRealmInfo, aggregateInfo);
28 }
29
30 @Override
31 public AuthenticationInfo afterAllAttempts(AuthenticationToken token, AuthenticationInfo aggregate) throws AuthenticationException {
32 //we know if one or more were able to succesfully authenticate if the aggregated account object does not
33 //contain null or empty data:
34 if (aggregate == null || CollectionUtils.isEmpty(aggregate.getPrincipals())) {
35 throw new AuthenticationException("Authentication token of type [" + token.getClass() + "] " +
36 "could not be authenticated by any configured realms. Please ensure that at least one realm can " +
37 "authenticate these tokens.");
38 }
39
40 return aggregate;
41 }
42 }
我的想法是这样的...只要Realm返回的info不为空,就把它作为aggregate储存起来...否则直接返回aggregate....所以我override了merge方法...并在afterAttemp里调用它....
然后所有Realm都处理完毕以后..如果aggregate是null...说明所有Realm都验证失败了...那么应该抛出异常....这里逻辑我就直接抄AtLeastOneSuccessfulStrategy类的代码了...
测试代码直接修改教程的就行了
1 @Test
2 public void testHelloworld2() {
3 // 1、获取SecurityManager工厂，此处使用Ini配置文件初始化SecurityManager
4 Factory<org.apache.shiro.mgt.SecurityManager> factory = new IniSecurityManagerFactory(
5 "classpath:shiro2.ini");
6
7 // 2、得到SecurityManager实例 并绑定给SecurityUtils
8 org.apache.shiro.mgt.SecurityManager securityManager = factory
9 .getInstance();
10 SecurityUtils.setSecurityManager(securityManager);
11
12 // 3、得到Subject及创建用户名/密码身份验证Token（即用户身份/凭证）
13 Subject subject = SecurityUtils.getSubject();
14 UsernamePasswordToken token = new UsernamePasswordToken("zhang", "123");
15
16 try {
17 // 4、登录，即身份验证
18 subject.login(token);
19 }
20 catch (AuthenticationException e) {
21 // 5、身份验证失败
22 }
23
24 Assert.assertEquals(true, subject.isAuthenticated()); // 断言用户已经登录
25 System.out.println(subject.getPrincipal());
26
27 // 6、退出
28 subject.logout();
29 }
shiro2.ini也修改自教程
1 [main]
2 #指定securityManager的authenticator实现
3 authenticator=org.apache.shiro.authc.pam.ModularRealmAuthenticator
4 securityManager.authenticator=$authenticator
5
6 #指定securityManager.authenticator的authenticationStrategy
7 lastSuccessfulStrategy=org.apache.shiro.authc.pam.AtLeastOneSuccessfulStrategy
8 securityManager.authenticator.authenticationStrategy=$lastSuccessfulStrategy
9
10 myRealm1=com.github.zhangkaitao.shiro.chapter2.realm.MyRealm1
11 myRealm2=com.github.zhangkaitao.shiro.chapter2.realm.MyRealm2
12 myRealm3=com.github.zhangkaitao.shiro.chapter2.realm.MyRealm3
13 securityManager.realms=$myRealm1,$myRealm3,$myRealm2
3个Realm我就不贴了...和教程是一样的....
这样我自己的LastSuccessfulStrategy策略就完成啦O(∩_∩)O哈！