第二十章

zhangkaitao · zhangkaitao · commit da7089c93467 · 2014-03-01T19:52:43.000+08:00
diff --git a/shiro-example-chapter20/src/main/java/com/github/zhangkaitao/shiro/chapter20/filter/StatelessAuthcFilter.java b/shiro-example-chapter20/src/main/java/com/github/zhangkaitao/shiro/chapter20/filter/StatelessAuthcFilter.java
@@ -25,27 +25,32 @@ protected boolean isAccessAllowed(ServletRequest request, ServletResponse respon
 
     @Override
     protected boolean onAccessDenied(ServletRequest request, ServletResponse response) throws Exception {
+        //1、客户端生成的消息摘要
         String clientDigest = request.getParameter(Constants.PARAM_DIGEST);
+        //2、客户端传入的用户身份
         String username = request.getParameter(Constants.PARAM_USERNAME);
+        //3、客户端请求的参数列表
         Map<String, String[]> params = new HashMap<String, String[]>(request.getParameterMap());
         params.remove(Constants.PARAM_DIGEST);
 
+        //4、生成无状态Token
         StatelessToken token = new StatelessToken(username, params, clientDigest);
 
         try {
+            //5、委托给Realm进行登录
             getSubject(request, response).login(token);
         } catch (Exception e) {
             e.printStackTrace();
-            onLoginFail(response);
+            onLoginFail(response); //6、登录失败
             return false;
         }
         return true;
     }
 
+    //登录失败时默认返回401状态码
     private void onLoginFail(ServletResponse response) throws IOException {
         HttpServletResponse httpResponse = (HttpServletResponse) response;
         httpResponse.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
         httpResponse.getWriter().write("login error");
     }
-
 }
diff --git a/shiro-example-chapter20/src/main/java/com/github/zhangkaitao/shiro/chapter20/realm/StatelessRealm.java b/shiro-example-chapter20/src/main/java/com/github/zhangkaitao/shiro/chapter20/realm/StatelessRealm.java
@@ -16,34 +16,36 @@
  * <p>Version: 1.0
  */
 public class StatelessRealm extends AuthorizingRealm {
-
     @Override
     public boolean supports(AuthenticationToken token) {
+        //仅支持StatelessToken类型的Token
         return token instanceof StatelessToken;
     }
-
     @Override
     protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {
-        //根据用户名查找角色
+        //根据用户名查找角色，请根据需求实现
         String username = (String) principals.getPrimaryPrincipal();
         SimpleAuthorizationInfo authorizationInfo =  new SimpleAuthorizationInfo();
         authorizationInfo.addRole("admin");
         return authorizationInfo;
     }
-
     @Override
     protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
         StatelessToken statelessToken = (StatelessToken) token;
         String username = statelessToken.getUsername();
-        String key = getKey(username);
+        String key = getKey(username);//根据用户名获取密钥（和客户端的一样）
+        //在服务器端生成客户端参数消息摘要
         String serverDigest = HmacSHA256Utils.digest(key, statelessToken.getParams());
+        System.out.println(statelessToken.getClientDigest());
+        System.out.println(serverDigest);
+        //然后进行客户端消息摘要和服务器端消息摘要的匹配
         return new SimpleAuthenticationInfo(
                 username,
                 serverDigest,
                 getName());
     }
 
-    private String getKey(String username) {
+    private String getKey(String username) {//得到密钥，此处硬编码一个
         if("admin".equals(username)) {
             return "dadadswdewq2ewdwqdwadsadasd";
         }
diff --git a/shiro-example-chapter20/src/main/resources/spring-config-shiro.xml b/shiro-example-chapter20/src/main/resources/spring-config-shiro.xml
@@ -8,13 +8,15 @@
        http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd
        http://www.springframework.org/schema/aop http://www.springframework.org/schema/aop/spring-aop.xsd">
 
-<!-- Realm实现 -->
+    <!-- Realm实现 -->
     <bean id="statelessRealm" class="com.github.zhangkaitao.shiro.chapter20.realm.StatelessRealm">
         <property name="cachingEnabled" value="false"/>
     </bean>
 
+    <!-- Subject工厂 -->
     <bean id="subjectFactory" class="com.github.zhangkaitao.shiro.chapter20.mgt.StatelessDefaultSubjectFactory"/>
 
+    <!-- 会话管理器 -->
     <bean id="sessionManager" class="org.apache.shiro.session.mgt.DefaultSessionManager">
         <property name="sessionValidationSchedulerEnabled" value="false"/>
     </bean>
diff --git a/shiro-example-chapter20/src/main/resources/spring-mvc.xml b/shiro-example-chapter20/src/main/resources/spring-mvc.xml
@@ -19,7 +19,6 @@
                                 expression="org.springframework.web.bind.annotation.ControllerAdvice"/>
     </context:component-scan>
 
+    <mvc:annotation-driven/>
 
-    <mvc:annotation-driven>
-    </mvc:annotation-driven>
 </beans>
diff --git a/shiro-example-chapter20/src/test/java/com/github/zhangkaitao/shiro/chapter20/ClientTest.java b/shiro-example-chapter20/src/test/java/com/github/zhangkaitao/shiro/chapter20/ClientTest.java
@@ -55,7 +55,7 @@ public void testServiceHelloSuccess() {
         params.add(Constants.PARAM_DIGEST, HmacSHA256Utils.digest(key, params));
 
         String url = UriComponentsBuilder
-                .fromHttpUrl("http://localhost:8080/hello1")
+                .fromHttpUrl("http://localhost:8080/hello")
                 .queryParams(params).build().toUriString();
 
         ResponseEntity responseEntity = restTemplate.getForEntity(url, String.class);
@@ -78,7 +78,7 @@ public void testServiceHelloFail() {
         params.set("param2", param2 + "1");
 
         String url = UriComponentsBuilder
-                .fromHttpUrl("http://localhost:8080/hello1")
+                .fromHttpUrl("http://localhost:8080/hello")
                 .queryParams(params).build().toUriString();
 
         try {
