如何在Shiro中从多个领域获得特定领域进行授权？

Question

I am newbie to Spring and Shiro platforms.

I have two url sets /admin/-- and /vendor/-- . Both client sets are authenticating with specific realms. I have extended ModularRealmAuthenticator class to choose correct realm for authenticating.

ModularRealmAuthenticator.java

@Override
protected AuthenticationInfo doAuthenticate(AuthenticationToken authenticationToken) throws AuthenticationException {
    assertRealmsConfigured();
    MultiLoginAuthenticationToken mlat = null;
    Realm loginRealm = null;

    if (!(authenticationToken instanceof MultiLoginAuthenticationToken)) {
        throw new AuthenticationException("Unrecognized token , not a typeof MultiLoginAuthenticationToken ");
    } else {
        mlat = (MultiLoginAuthenticationToken) authenticationToken;
        logger.debug("realm name is : {}", mlat.getRealmName());
        loginRealm = lookupRealm(mlat.getRealmName());
    }

    return doSingleRealmAuthentication(loginRealm, mlat);

}

protected Realm lookupRealm(String realmName) throws AuthenticationException {
    Collection<Realm> realms = getRealms();
    for (Realm realm : realms) {
        if (realm.getName().equalsIgnoreCase(realmName)) {
            logger.debug("look up realm name is : {}", realm.getName());
            return realm;
        }
    }
    throw new AuthenticationException("No realm configured for Client " + realmName);
}

But while I am assigning role and permissions from different set of datasource to both clients (Admin and vendor). It is iterating the realms in order which I have defined in applicationContext.xml file.

My ApplicationContext.xml

<bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">

    <property name="authenticator">
        <bean class="com.yatra.mp.security.MultiLoginAuthenticator"/>
    </property>

    <!-- Single realm app (realm configured next, below). If you have multiple 
        realms, use the 'realms' property instead. -->
    <property name="realms">
        <util:list>
            <ref bean="adminAuthRealm" />
            <ref bean="vendorAuthRealm" />              
        </util:list>
    </property>

    <property name="cacheManager" ref="cacheManager" />
</bean>

In both of realms are extending AuthorizingRealm class and both have doGetAuthorizationInfo and doGetAuthenticationInfo method. In which I have defined my custom implementation.

Is it necessary to extend ModularRealmAuthorizer class? If yes, could you please tell me which method I have override?

Answer 1

What you can do is add the domain info to the PrincipalCollection you can wrap in the AuthenticationInfo. It is an added token in the principal collection that gets carried over in subsequent shiro calls. You can use that info in the authentication to skip if it doesn't match your realm. This is actually what we do in our custom realm:

public class OurRealmImpl extends AuthorizingRealm

...
    @Override
    public AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) {
        ... //check if user exists and read passwordhash
        Login ourLoginToken = ...
        SimplePrincipalCollection principalCollection = new SimplePrincipalCollection(ourLoginToken, realmName);
        return new SimpleAuthenticationInfo(principalCollection, passwordHash);
    }

    @Override
    public AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {
        Collection collection = principals.fromRealm(realmName);
        if (collection.isEmpty()) {
           return null;
        }
        Login login = (Login) collection.iterator().next();
        ... get the rights and return authorization
        SimpleAuthorizationInfo info = new SimpleAuthorizationInfo();
        info.addStringPermissions(permissionStrings);
        return info;
    }

Answer 2

i met that problem too. finally, i solved it. step as the follow:

1) let a new class to extend the ModularRealmAuthorizer.

public class OurModularRealmAuthorizer extend ModularRealmAuthorizer{
  private map<string,OurAuthorizerRealm> mRealms;
  private map<string,OurAuthorizerRealm> getMRealms(){return mRealms;}
  private void setMRealms(map<string,OurAuthorizerRealm> mrealms){
      this.mRealms = mrealms;
      Collection<Realm> tmpRealms = new ArrayList<Realm>();

        for (OurAuthorizerRealm value : mrealms.values()) {
            Realm realm = (Realm) value;
            tmpRealms.add(realm);
        }

        this.realms = tmpRealms;/*setting realms*/
  }
}

2. spring-shiro.xml:

<bean id="ourModularRealmAuthorizer" class="xx.xxx.shiro.realm.ShiroModularRealmAuthorizer">
        <property name="mRealms">
            <map>
                <entry key="ourAuthorizerRealm1" value-ref="ourAuthorizerRealm1" />
                <entry key="ourAuthorizerRealm2" value-ref="ourAuthorizerRealm2" />
            </map>
        </property>
    </bean>
    <bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
        <property name="authenticator" ref="ourModularRealmAuthenticator"></property>
        <property name="authorizer" ref="ouModularRealmAuthorizer"></property>
        <property name="cacheManager" ref="shiroCacheManager"></property>
    </bean>

all right.