shiro安全框架扩展教程--如何扩展realm桥接器并退出自动清空角色资源缓存

        上一章节我们知道了如何扩展自己的缓存机制,下面我们就学习下如何应用自己的自定义缓存,我们登录都必须要写一个realm,就是所谓的桥接器;

鉴于我们登录都会把拥有的角色放到缓存,这样都不用每次请求都要访问一次数据库,导致亚历山大,当退出的时候又如何自动我们登录时添加的缓存数据

下面帖个展示代码

package com.silvery.security.shiro.realm;

import java.text.SimpleDateFormat;
import java.util.ArrayList;
import java.util.Date;
import java.util.HashMap;
import java.util.List;
import java.util.Map;

import org.apache.shiro.authc.AuthenticationException;
import org.apache.shiro.authc.AuthenticationInfo;
import org.apache.shiro.authc.AuthenticationToken;
import org.apache.shiro.authc.SimpleAuthenticationInfo;
import org.apache.shiro.authc.UsernamePasswordToken;
import org.apache.shiro.authz.AuthorizationInfo;
import org.apache.shiro.authz.SimpleAuthorizationInfo;
import org.apache.shiro.realm.AuthorizingRealm;
import org.apache.shiro.subject.PrincipalCollection;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.annotation.Autowired;

import com.silvery.core.model.ViewResult;
import com.silvery.project.cms.model.Authority;
import com.silvery.project.cms.model.UserDetails;
import com.silvery.project.cms.service.AuthorityService;
import com.silvery.project.cms.service.UserDetailsService;
import com.silvery.project.cms.vo.AuthorityVo;
import com.silvery.project.cms.vo.UserDetailsVo;
import com.silvery.security.shiro.cache.SimpleMapCache;
import com.silvery.security.shiro.cache.extend.SimpleCacheManager;

/**
 * 
 * 安全框架桥接器
 * 
 * @author shadow
 * 
 */
public class SimpleUserRealm extends AuthorizingRealm {

	private final static Logger log = LoggerFactory.getLogger(SimpleUserRealm.class);

	@Autowired
	private UserDetailsService userDetailsService;

	@Autowired
	private AuthorityService authorityService;

	@Autowired
	private SimpleCacheManager simpleCacheManager;

	// 授权当前用户信息
	protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {
		return getAuthorizationInfo(principals.getPrimaryPrincipal());
	}

	@SuppressWarnings("unchecked")
	private SimpleAuthorizationInfo getAuthorizationInfo(Object principal) {

		List<Authority> authorities = null;

		// 获取缓存,如失败缓存则返回空角色集合
		try {
			authorities = (List<Authority>) simpleCacheManager.getCache(principal.toString()).get(principal);
		} catch (Exception e) {
			authorities = new ArrayList<Authority>();
			log.error(e.getMessage());
		}

		SimpleAuthorizationInfo authorizationInfo = new SimpleAuthorizationInfo();

		// 添加角色到安全认证实体
		for (Authority authority : authorities) {
			authorizationInfo.addRole((authority.getName()));
		}

		return authorizationInfo;

	}

	// 用户登录认证
	protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authcToken) throws AuthenticationException {

		UsernamePasswordToken token = (UsernamePasswordToken) authcToken;

		UserDetailsVo vo = new UserDetailsVo();
		vo.setUsername(token.getUsername());
		vo.setPassword(String.valueOf(token.getPassword()));
		vo.setJcaptionCode(token.getHost());

		// 使用用户服务类接口查询用户是否存在
		ViewResult viewResult = userDetailsService.login(vo);

		if (viewResult.getSuccess()) {
			UserDetails details = (UserDetails) viewResult.getValue();
			// 加载用户相应角色到缓存
			loadUserAuthorityTocache(details);
			// 返回安全框架认证信息
			return new SimpleAuthenticationInfo(details.getUsername(), details.getPassword(), getName());
		} else {
			log.debug(new StringBuffer().append(token.getUsername()).append(" login failure at ").append(
					new SimpleDateFormat("yyyy-MM-dd HH:mm:ss").format(new Date())).append(", error message: ").append(
					viewResult.getMessage()).toString());
			// 失败情况抛出异常并返回服务层相应错误信息
			throw new AuthenticationException(viewResult.getMessage());
		}

	}

	/**
	 * 加载用户角色
	 * 
	 * @param details
	 */
	private void loadUserAuthorityTocache(UserDetails details) {

		// 使用当前用户名作为cache key
		String cacheKey = details.getUsername();

		AuthorityVo vo = new AuthorityVo();
		vo.setUser_id(details.getId());

		// 查询用户角色并存放到map
		Map<Object, Object> map = new HashMap<Object, Object>();
		map.put(cacheKey, authorityService.find4user(vo).getValue());

		// 新建cache实例并放入缓存管理器
		SimpleMapCache cache = new SimpleMapCache(cacheKey, map);
		simpleCacheManager.createCache(details.getUsername(), cache);

	}

	/** 重写退出时缓存处理方法 */
	protected void doClearCache(PrincipalCollection principalcollection) {
		Object principal = principalcollection.getPrimaryPrincipal();
		simpleCacheManager.removeCache(principal.toString());
		log.debug(new StringBuffer().append(principal).append(" on logout to remove the cache [").append(principal)
				.append("]").toString());
	}

}

1. 明显看到登录流程中,我们使用自己定义的缓存管理器,登录认证成功后,然后加载出该用户的相关角色,然后放到缓存中

2. 用户认证的时候,是通过我们的自定义缓存管理器读取资源,实现我们不用第二次查询数据库的需求

3. 如何在退出的自动清空相关缓存呢?可以看到我是重写doClearCache方法,为何要重写?先看看下面帖上来的源码

public abstract class CachingRealm
    implements Realm, Nameable, CacheManagerAware, LogoutAware
{

    public CachingRealm()
    {
        cachingEnabled = true;
        name = (new StringBuilder()).append(getClass().getName()).append("_").append(INSTANCE_COUNT.getAndIncrement()).toString();
    }

    public CacheManager getCacheManager()
    {
        return cacheManager;
    }

    public void setCacheManager(CacheManager cacheManager)
    {
        this.cacheManager = cacheManager;
        afterCacheManagerSet();
    }

    public boolean isCachingEnabled()
    {
        return cachingEnabled;
    }

    public void setCachingEnabled(boolean cachingEnabled)
    {
        this.cachingEnabled = cachingEnabled;
    }

    public String getName()
    {
        return name;
    }

    public void setName(String name)
    {
        this.name = name;
    }

    protected void afterCacheManagerSet()
    {
    }

    public void onLogout(PrincipalCollection principals)
    {
        clearCache(principals);
    }

    protected void clearCache(PrincipalCollection principals)
    {
        if(!CollectionUtils.isEmpty(principals))
        {
            doClearCache(principals);
            log.trace("Cleared cache entries for account with principals [{}]", principals);
        }
    }

    protected void doClearCache(PrincipalCollection principalcollection)
    {
    }

    protected Object getAvailablePrincipal(PrincipalCollection principals)
    {
        Object primary = null;
        if(!CollectionUtils.isEmpty(principals))
        {
            Collection thisPrincipals = principals.fromRealm(getName());
            if(!CollectionUtils.isEmpty(thisPrincipals))
                primary = thisPrincipals.iterator().next();
            else
                primary = principals.getPrimaryPrincipal();
        }
        return primary;
    }

    private static final Logger log = LoggerFactory.getLogger(org/apache/shiro/realm/CachingRealm);
    private static final AtomicInteger INSTANCE_COUNT = new AtomicInteger();
    private String name;
    private boolean cachingEnabled;
    private CacheManager cacheManager;

}

明显看到有个方法onLogout处理安全退出时的动作,然后试着重写这个方法加入我们remove cache的动作,这样就可以完美实现退出的时候自动清空自己的角色资源缓存,

但是有人会问,如果我不使用安全退出那资源会一直保留吗?

这个是肯定的,但是当他下次登录,会重新加载资源覆盖之前的角色资源缓存

这次的试验比较简单,但是实用,相信对大家会有帮助,谢谢