快捷導(dǎo)航

Shrio框架實(shí)現(xiàn)自定義密碼校驗(yàn)規(guī)則詳解

更新時(shí)間：2026年03月14日 09:16:23 作者：陪妳去流浪丶

文章主要介紹了Shiro框架的密碼校驗(yàn)機(jī)制,包括內(nèi)置的校驗(yàn)規(guī)則和自定義校驗(yàn)規(guī)則的實(shí)現(xiàn),在Shiro中,密碼校驗(yàn)主要通過自定義Realm來實(shí)現(xiàn),具體步驟包括定義用戶認(rèn)證信息和權(quán)限信息,并在CredentialsMatcher中實(shí)現(xiàn)用戶信息校驗(yàn)對(duì)比

1.shiro的密碼校驗(yàn)是如何做的？

我們?cè)诘卿浄椒▋?nèi)做完參數(shù)校驗(yàn)，驗(yàn)證碼匹配等基本工作之后，都會(huì)將用戶名和密碼通過subject.login(auth) 傳入框架來做用戶匹配，但是，是和什么地方的數(shù)據(jù)進(jìn)行匹配呢？

UsernamePasswordToken auth = new UsernamePasswordToken(username, password,false);
Subject subject = SecurityUtils.getSubject();
subject.login(auth);

答案就是在自定義的Realm中定義的AuthenticationInfo 進(jìn)行匹配

可以通過shiro框架源碼AuthenticatingRealm類的 assertCredentialsMatch方法看到，傳入了兩個(gè)參數(shù)，token就是我們登陸方法中傳入的UsernamePasswordToken對(duì)象，而info就是我們?cè)卺斸斠籖ealm中doGetAuthenticationInfo 方法中定義的info對(duì)象。

shiro框架校驗(yàn)：

//shiro源碼--用戶信息認(rèn)證 對(duì)比
 protected void assertCredentialsMatch(AuthenticationToken token, AuthenticationInfo info) throws AuthenticationException {
        CredentialsMatcher cm = this.getCredentialsMatcher();
        if (cm != null) {
            //信息認(rèn)證
            if (!cm.doCredentialsMatch(token, info)) {
                String msg = "Submitted credentials for token [" + token + "] did not match the expected credentials.";
                throw new IncorrectCredentialsException(msg);
            }
        } else {
            throw new AuthenticationException("A CredentialsMatcher must be configured in order to verify credentials during authentication.  If you do not wish for credentials to be examined, you can configure an " + AllowAllCredentialsMatcher.class.getName() + " instance.");
        }
    }

這里需要弄清楚 doGetAuthenticationInfo和doGetAuthorizationInfo 前者是定義用戶認(rèn)證信息的，而后者是定義用戶權(quán)限信息，有點(diǎn)容易混淆。

2.實(shí)現(xiàn)自定義Realm

public class ShiroFileRealm extends AuthorizingRealm implements InitializingBean {
	
	@Autowired
	public void setCredentialsDigest(CredentialsDigest credentialsDigest) {
		this.credentialsDigest = credentialsDigest;
	}

	@Override
	protected AuthenticationInfo doGetAuthenticationInfo(
			AuthenticationToken authcToken) throws AuthenticationException {
		UsernamePasswordToken token = (UsernamePasswordToken) authcToken;
		User user = userService.getUser(token.getUsername());
		if (user != null) {
            //此處返回的對(duì)象就是上面的info
			return new SimpleAuthenticationInfo(new ShiroUser(user.getUsername()), user.getPassword(),getName());
		}
		return null;
	}

	@Override
	protected AuthorizationInfo doGetAuthorizationInfo(
			PrincipalCollection principals) {
		//自定義用戶權(quán)限
		SimpleAuthorizationInfo info = new SimpleAuthorizationInfo();
		
		return info;
	}
	/**
	 * 設(shè)定密碼校驗(yàn)規(guī)則
	 */
	public void afterPropertiesSet() throws Exception {
		CredentialsMatcher matcher = new CredentialsMatcherAdapter(credentialsDigest);
		setCredentialsMatcher(matcher);
	}

}

上面代碼中SimpleAuthenticationInfo 就是返回的用戶認(rèn)證信息，也是框架中做對(duì)比的info

好了，認(rèn)證流程基本弄明白，我們就需要實(shí)現(xiàn)自定義校驗(yàn)，怎么做呢？

3.實(shí)現(xiàn)自定義CredentialsMatcher 認(rèn)證類

/**
	 * 設(shè)定密碼校驗(yàn)規(guī)則
	 */
	public void afterPropertiesSet() throws Exception {
		CredentialsMatcher matcher = new CredentialsMatcherAdapter(credentialsDigest);
		//設(shè)置自定義的用戶信息認(rèn)證類
        setCredentialsMatcher(matcher);
	}

關(guān)鍵就是這里，CredentialsMatcherAdapter 是個(gè)實(shí)現(xiàn)了CredentialsMatcher接口的自定義類

public class CredentialsMatcherAdapter implements CredentialsMatcher {
    private CredentialsDigest credentialsDigest;

    public CredentialsMatcherAdapter(CredentialsDigest credentialsDigest) {
        Assert.notNull(credentialsDigest, "The argument must not be null");
        this.credentialsDigest = credentialsDigest;
    }

    public boolean doCredentialsMatch(AuthenticationToken token, AuthenticationInfo info) {
        String plainCredentials, credentials;
        byte[] saltByte = null;
        plainCredentials = toStringCredentials(token.getCredentials());
        if (info instanceof SaltedAuthenticationInfo) {
            ByteSource salt = ((SaltedAuthenticationInfo) info).getCredentialsSalt();
            if (salt != null) saltByte = salt.getBytes();
        }
        credentials = toStringCredentials(info.getCredentials());
        if(saltByte != null){
            return credentialsDigest.matches(credentials, plainCredentials, saltByte);
        }
        return credentialsDigest.matches(credentials, plainCredentials);
    }

    private static String toStringCredentials(Object credentials) {
        if (credentials == null) {
            return null;
        } else if (credentials instanceof String) {
            return (String) credentials;
        } else if (credentials instanceof char[]) {
            return new String((char[]) credentials);
        } else {
            throw new IllegalArgumentException("credentials only support String or char[].");
        }
    }
}

doCredentialsMatch 方法就是實(shí)現(xiàn)用戶信息校驗(yàn) 對(duì)比的方法，上面shiro框架的校驗(yàn)流程（cm.doCredentialsMatch(token, info)）就會(huì)走到我們這里的方法中

上面credentialsDigest.matches(credentials, plainCredentials); 是我自己實(shí)現(xiàn)的密碼比較方法

有加鹽模式和無鹽模式

貼出來給大家參考下

接口

public interface CredentialsDigest {
    String digest(String plainCredentials, byte[] salt);
    boolean matches(String credentials, String plainCredentials, byte[] salt);
    boolean matches(String credentials, String plainCredentials);
}

實(shí)現(xiàn)類

public  abstract class HashCredentialsDigest implements CredentialsDigest {
    static final int HASH_ITERATIONS = 1024;
    public String digest(String plainCredentials, byte[] salt) {
        if (StringUtils.isBlank(plainCredentials)) return null;
        byte[] hashPassword = digest(plainCredentials.getBytes(StandardCharsets.UTF_8), salt);
        return Hex.encodeHexString(hashPassword);
    }
    public boolean matches(String credentials, String plainCredentials, byte[] salt) {
        if (StringUtils.isBlank(credentials) && StringUtils.isBlank(plainCredentials)) return true;
        return StringUtils.equals(credentials, digest(plainCredentials, salt));
    }
    public boolean matches(String credentials, String plainCredentials) {
        if (StringUtils.isBlank(credentials) && StringUtils.isBlank(plainCredentials)) return true;
        return StringUtils.equals(credentials, plainCredentials);
    }
    protected abstract byte[] digest(byte[] input, byte[] salt);
}

主要的自定義代碼就在CredentialsMatcherAdapter和CredentialsDigest中。。。