shiro源码篇 - shiro认证与授权，你值得拥有

protected FilterChainManager createFilterChainManager() {

    DefaultFilterChainManager manager = new DefaultFilterChainManager();
    Map<String, Filter> defaultFilters = manager.getFilters();
    //apply global settings if necessary:    应用全局设置
    for (Filter filter : defaultFilters.values()) {
        applyGlobalPropertiesIfNecessary(filter);
    }

    //Apply the acquired and/or configured filters: 应用和配置filter，一般没有
    Map<String, Filter> filters = getFilters();
    if (!CollectionUtils.isEmpty(filters)) {
        for (Map.Entry<String, Filter> entry : filters.entrySet()) {
            String name = entry.getKey();
            Filter filter = entry.getValue();
            applyGlobalPropertiesIfNecessary(filter);
            if (filter instanceof Nameable) {
                ((Nameable) filter).setName(name);
            }
            //'init' argument is false, since Spring-configured filters should be initialized
            //in Spring (i.e. 'init-method=blah') or implement InitializingBean:
            manager.addFilter(name, filter, false);
        }
    }

    //build up the chains:  构建shiro filter链
    Map<String, String> chains = getFilterChainDefinitionMap();
    if (!CollectionUtils.isEmpty(chains)) {
        for (Map.Entry<String, String> entry : chains.entrySet()) {
            String url = entry.getKey();
            String chainDefinition = entry.getValue();
            manager.createChain(url, chainDefinition);
        }
    }

    return manager;
}

//apply global settings if necessary:
for (Filter filter : defaultFilters.values()) {
    applyGlobalPropertiesIfNecessary(filter);
}


private void applyGlobalPropertiesIfNecessary(Filter filter) {
    applyLoginUrlIfNecessary(filter);            // 设置filter的loginUrl
    applySuccessUrlIfNecessary(filter);            // 设置filter的successUrl
    applyUnauthorizedUrlIfNecessary(filter);    // 这个我们一般没有配置
}

private void applyLoginUrlIfNecessary(Filter filter) {
    String loginUrl = getLoginUrl();    // shiroFilterFactoryBean.setLoginUrl("/login"); 设置的loginUrl
    if (StringUtils.hasText(loginUrl) && (filter instanceof AccessControlFilter)) {
        AccessControlFilter acFilter = (AccessControlFilter) filter;
        //only apply the login url if they haven't explicitly configured one already:
        String existingLoginUrl = acFilter.getLoginUrl();
        if (AccessControlFilter.DEFAULT_LOGIN_URL.equals(existingLoginUrl)) {
            acFilter.setLoginUrl(loginUrl);
        }
    }
}

private void applySuccessUrlIfNecessary(Filter filter) {
    String successUrl = getSuccessUrl();    // shiroFilterFactoryBean.setSuccessUrl("/index"); 设置的successUrl
    if (StringUtils.hasText(successUrl) && (filter instanceof AuthenticationFilter)) {
        AuthenticationFilter authcFilter = (AuthenticationFilter) filter;
        //only apply the successUrl if they haven't explicitly configured one already:
        String existingSuccessUrl = authcFilter.getSuccessUrl();
        if (AuthenticationFilter.DEFAULT_SUCCESS_URL.equals(existingSuccessUrl)) {
            authcFilter.setSuccessUrl(successUrl);
        }
    }
}

private void applyUnauthorizedUrlIfNecessary(Filter filter) {
    String unauthorizedUrl = getUnauthorizedUrl();
    if (StringUtils.hasText(unauthorizedUrl) && (filter instanceof AuthorizationFilter)) {
        AuthorizationFilter authzFilter = (AuthorizationFilter) filter;
        //only apply the unauthorizedUrl if they haven't explicitly configured one already:
        String existingUnauthorizedUrl = authzFilter.getUnauthorizedUrl();
        if (existingUnauthorizedUrl == null) {
            authzFilter.setUnauthorizedUrl(unauthorizedUrl);
        }
    }
}

public boolean onPreHandle(ServletRequest request, ServletResponse response, Object mappedValue) throws Exception {
        return isAccessAllowed(request, response, mappedValue) || onAccessDenied(request, response, mappedValue);
    }

protected boolean isAccessAllowed(ServletRequest request, ServletResponse response, Object mappedValue) {
    return super.isAccessAllowed(request, response, mappedValue) ||
            (!isLoginRequest(request, response) && isPermissive(mappedValue));
}

// super.isAccessAllowed判断时候已经认证过，有个标志字段:authenticated
// isLoginRequest判断是否是登录请求，很显然不是，登录请求是/login，目前是/
// isPermissive 没搞明白，可能应对一些特殊的filter


protected boolean onAccessDenied(ServletRequest request, 
    ServletResponse response, Object mappedValue) throws Exception {
    return onAccessDenied(request, response);
}

protected boolean onAccessDenied(ServletRequest request, ServletResponse response) throws Exception {
    if (isLoginRequest(request, response)) {    // 是否是登录请求
        if (isLoginSubmission(request, response)) {    // 是否是post请求
            if (log.isTraceEnabled()) {
                log.trace("Login submission detected.  Attempting to execute login.");
            }
            return executeLogin(request, response);    // 执行登录
        } else {
            if (log.isTraceEnabled()) {
                log.trace("Login page view.");
            }
            //allow them to see the login page ;)
            return true;    // get方式的登录请求则继续执行filter链，最终会来到我们的controller的登录get请求
        }
    } else {
        if (log.isTraceEnabled()) {
            log.trace("Attempting to access a path which requires authentication.  Forwarding to the " +
                    "Authentication url [" + getLoginUrl() + "]");
        }

        saveRequestAndRedirectToLogin(request, response); // 重定向到/login
        return false;    // 返回false，表示filter链不继续执行了
    }
}

@PostMapping("/login")
@ResponseBody
public OwnResult dologin(String username, String password) {
    username = username.trim();
    // 判断当前用户是否可用
    User user = userService.findUserByUsername(username);
    if(user == null) {
        return OwnResult.build(RespCode.ERROR_USER_NOT_EXIST.getCode(), username + " 用户不存在");
    }
    if (user.getStatus() == Constants.USER_DISABLED) {
        return OwnResult.build(RespCode.ERROR_USER_DISABLED.getCode(), "账号已被禁用, 请联系管理员");
    }

    UsernamePasswordToken token = new UsernamePasswordToken(username, password);
    Subject subject = SecurityUtils.getSubject();
    try {
        subject.login(token);        // 登录认证交给shiro
        return OwnResult.ok();
    } catch (AuthenticationException e) {
        return OwnResult.build(RespCode.ERROR_USERNAME_PASSWORD.getCode(), "用户名或密码错误");
    }
}

@RequestMapping({"/","/index"})
public String index(Model model){

    List<Menu> menus = menuService.listMenu();
    model.addAttribute("menus", menus);
    model.addAttribute("username", getUsername());
    return "index_v1";
}