本文主要實踐用spring boot + shiro+ ehcache實現使用者登入錯誤次數的判斷，關於spring boot， shiro， ehcache的理論知識這裡將不作為介紹，這些知識可以在它們的官網或其它部落格上能夠找到 。下面將進入正文：

pom.xml

本文主要引用的jar如下：

<dependency>
    <groupId>org.apache.shiro</groupId>
    <artifactId>shiro-spring</artifactId>
    <version>1.4.0</version>
</dependency>
<dependency>
    <groupId>org.apache.shiro</groupId>
    <artifactId>shiro-ehcache</artifactId>
    <version>1.4.0</version>
</dependency>
 

用於我們將使用shiro + ehache配合使用，所以可以不用單獨再引用ehcache.jar了，使用shiro-ehcache時，會自動新增ehcache-core 2.6.11。

ehcache.xml

由於我們使用了ehcache，所以我們需要新增一個配置檔案ehcache.xml,此檔案目錄為src/main/resources/config/ehcache.xml，內容如下：

<?xml version="1.0" encoding="UTF-8"?>
<ehcache xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:noNamespaceSchemaLocation="http://ehcache.org/ehcache.xsd"
    updateCheck="false"
    dynamicConfig="true"
    name="ehcache_retry">

    <!-- 磁碟快取位置 -->
    <diskStore path="java.io.tmpdir/ehcache" />

    <!-- 預設快取 -->
    <defaultCache maxEntriesLocalHeap="10000" 
        eternal="false"
        timeToIdleSeconds="120" 
        timeToLiveSeconds="120" 
        maxEntriesLocalDisk="10000000"
        diskExpiryThreadIntervalSeconds="120" 
        memoryStoreEvictionPolicy="LRU">
        <persistence strategy="localTempSwap" />
    </defaultCache>

    <!-- helloworld快取 -->
    <cache name="passwordRetryCache" 
        maxElementsInMemory="2000" 
        eternal="false"
        timeToIdleSeconds="600" 
        timeToLiveSeconds="600" 
        overflowToDisk="false"
        statistics="true" />
</ehcache>
 

配置中不能對ehcache標籤新增monitoring="autodetect"，否側快取將無法儲存。

注：

    timeToIdleSeconds – The maximum number of seconds an element can exist in the cache without being accessed. The element expires at this limit and will no longer be returned from the cache. The default value is 0, which means no TTI eviction takes place (infinite lifetime). 

    timeToLiveSeconds – The maximum number of seconds an element can exist in the cache regardless of use. The element expires at this limit and will no longer be returned from the cache. The default value is 0, which means no TTL eviction takes place (infinite lifetime).

    maxElementsOnDisk – The maximum sum total number of elements (cache entries) allowed for a distributed cache in all Terracotta clients. If this target is exceeded, eviction occurs to bring the count within the allowed target. The default value is 0, which means no eviction takes place (infinite size is allowed). Note that this value reflects storage allocated on the Terracotta Server Array. A setting of 0 means that no eviction of the cache's entries takes place on Terracotta Server Array, and consequently can cause the servers to run out of disk space.

    eternal – If the cacheâ–s eternal flag is set, it overrides any finite TTI/TTL values that have been set

ShiroRealm.java

public class ShiroRealm extends AuthorizingRealm{
    @Override
    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {
        SimpleAuthorizationInfo authorizationInfo = new SimpleAuthorizationInfo();
        return authorizationInfo;
    }

	/* 登入驗證
	 * @see org.apache.shiro.realm.AuthenticatingRealm#doGetAuthenticationInfo(org.apache.shiro.authc.AuthenticationToken)
	 */
    @Override
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
        String userName = (String)token.getPrincipal();
        User user = this.userService.findByUserName(userName);
        if (user != null) {
            SimpleAuthenticationInfo info = new SimpleAuthenticationInfo(user, user.getPassword(), getName());
            info.setCredentialsSalt(new SimpleByteSource(ByteSource.Util.bytes(MD5Util.SALT)));
            return info;
        }
        return null;
    }
}

由於doGetAuthorizationInfo主要用於使用者授權部分，所以這裡沒有貼出程式碼，讀者可以根據自己的業務需求來完善該部分。對於方法doGetAuthenticationInfo中，讀者注意到info.setCredentialsSalt(new SimpleByteSource(ByteSource.Util.bytes(MD5Util.SALT)));，這個是因為我在儲存密碼時，用的shiro MD5+salt的方式加密，所以在這裡驗證的時候，必須與加密時的演算法保持一致，這樣才能夠驗證通過。由於HashedCredentialsMatcher不提供salt的設定，所以在返回AuthenticationInfo的時候需要把salt帶上一起返回出去。

RetryLimitCredentialsMatcher.java

public class RetryLimitCredentialsMatcher extends HashedCredentialsMatcher{
    private static final int MAX_LOGIN_RETRY_TIMES = 5;
    private Cache<String, AtomicInteger> passwordRetryCache;
	
    public RetryLimitCredentialsMatcher(EhCacheManager ehCacheManager) {
        passwordRetryCache = ehCacheManager.getCache("passwordRetryCache");
    }
	
    @Override
    public boolean doCredentialsMatch(AuthenticationToken token, AuthenticationInfo info) throws ExcessiveAttemptsException{
        String userName = (String) token.getPrincipal();
        AtomicInteger retryCount = passwordRetryCache.get(userName);
        if (retryCount == null) {
            // 高併發下使用的執行緒安全的int類
            retryCount = new AtomicInteger(0);
            passwordRetryCache.put(userName, retryCount);
        }
        if (retryCount.incrementAndGet() > MAX_LOGIN_RETRY_TIMES) {
            throw new ExcessiveAttemptsException();
        }
	
        boolean match = super.doCredentialsMatch(token, info);
        if (match) {
            passwordRetryCache.remove(userName);
        }
		
        return match;
    }
}

這個類的主要作用就是計算並快取使用者嘗試登陸的次數，如果大於了5次，那麼該使用者將被禁止登陸直到10分鐘以後。這個時間在ehcache.xml中timeToIdleSeconds設定。

ShiroConfig.java

對shiro進行配置：

@Configuration
public class ShiroConfig {
    @Bean
    public ShiroFilterFactoryBean shiroFilter(SecurityManager securityManager) {
        ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();
        shiroFilterFactoryBean.setSecurityManager(securityManager);
        Map<String, String> filterChainDefinitionMap = new LinkedHashMap<String, String>();
		
        filterChainDefinitionMap.put("/logout", "logout");
        filterChainDefinitionMap.put("/login", "user");
        //<!-- authc:所有url都必須認證通過才可以訪問; anon:所有url都都可以匿名訪問-->
        filterChainDefinitionMap.put("/css/**", "anon");
        filterChainDefinitionMap.put("/js/**", "anon");
        filterChainDefinitionMap.put("/img/**", "anon");
        filterChainDefinitionMap.put("/**", "authc");//if authc, all url should be authenticated 
        // 如果不設定預設會自動尋找Web工程根目錄下的"/login.jsp"頁面
        shiroFilterFactoryBean.setLoginUrl("/login");
        // 登入成功後要跳轉的連結
        shiroFilterFactoryBean.setSuccessUrl("/index");
		
        //未授權介面;
        shiroFilterFactoryBean.setUnauthorizedUrl("/403");
        shiroFilterFactoryBean.setFilterChainDefinitionMap(filterChainDefinitionMap);
		
        return shiroFilterFactoryBean;
    }
	
    @Bean
    public ShiroRealm shiroRealm() {
        ShiroRealm shiroRealm = new ShiroRealm();
        shiroRealm.setCredentialsMatcher(this.retryLimitCredentialsMatcher());
        return shiroRealm;
    }
	
    @Bean
    public SecurityManager securityManager() {
        DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager();
        securityManager.setRealm(this.shiroRealm());
        return securityManager;
    }
	
    @Bean
    public EhCacheManager ehCacheManager() {
        EhCacheManager ehCacheManager = new EhCacheManager();
        ehCacheManager.setCacheManagerConfigFile("classpath:config/ehcache.xml");
        return ehCacheManager;
    }
	
    @Bean
    public CredentialsMatcher retryLimitCredentialsMatcher() {
        RetryLimitCredentialsMatcher retryLimitCredentialsMatcher = new RetryLimitCredentialsMatcher(this.ehCacheManager());
        retryLimitCredentialsMatcher.setHashAlgorithmName(MD5Util.ALGORITH_NAME);
        retryLimitCredentialsMatcher.setHashIterations(MD5Util.HASH_ITERATIONS);
        retryLimitCredentialsMatcher.setStoredCredentialsHexEncoded(true);
        return retryLimitCredentialsMatcher;
    }
}

注：在這個類中，org.apache.shiro.cache.ehcache.EhCacheManager的作用是為了載入ehcache.xml,另外，retryLimitCredentialsMatcher的作用是為了設定一個和密碼加密演算法一樣的演算法，其中一定要設定Hash Algorithm Name（我用的是MD5），否則會有exception提示HashAlgorithmName必須設定，這是因為我們使用的ehcache版本為2.5及以上，在此時，如果還有異常

net.sf.ehcache.CacheException: Another CacheManager with same name 'MD5' already exists in the same VM.

這是由於在對密碼加密的時候也是使用的HashAlgorithmName = MD5，這個時候記憶體中已經存在了一個叫做MD5 CacheManager ，同時我們為了讓加密演算法和驗證時候的演算法也一樣，我們不得不在此也設定為MD5，所以需要在ehcache.xml中為cache設定一個name="ehcache_retry"，這也是為什麼讀者在前文中ehcache.xml中看到有name。

為了能夠使用RetryLimitCredentialsMatcher，我們需要在shiroRealm中將其設定進去，這樣一個使用者登入嘗試錯誤次數的判斷器就算做好了。

當然，我們使用的是spring boot，同時開啟了自動編譯，所以當代碼改動後，會自動重啟伺服器，這個時候你會發現又會出現以下exception

Caused by: net.sf.ehcache.CacheException: Another CacheManager with same name 'ehcache_retry' already exists in the same VM. Please provide unique names for each CacheManager in the config or do one of following:
1. Use one of the CacheManager.create() static factory methods to reuse same CacheManager with same name or create one if necessary
2. Shutdown the earlier cacheManager before creating new one with same name.
The source of the existing CacheManager is: InputStreamConfigurationSource [[email protected]]

這是用於之前的EhCacheManager還存在，並沒有因自動重啟而失效(除非是手動的關閉再重啟)，在重啟的時候回再次建立一個EhCacheManager，導致重複，為了解決這個問題，我們需要新增一個Listener來監聽當前application是否是關閉了又重啟。如果是，那麼我們將之前的EhCacheManager也關掉。

SpringEhcacheShutdownListener.java

@Component
public class SpringEhcacheShutdownListener implements ApplicationListener<ApplicationEvent>{

    @Override
    public void onApplicationEvent(ApplicationEvent event) {
        if (event instanceof ContextClosedEvent) {
            ApplicationContext context = ((ContextClosedEvent) event).getApplicationContext();
            EhCacheManager ehCacheManager = (EhCacheManager) context.getBean("ehCacheManager");
            if (ehCacheManager != null) {
                ehCacheManager.destroy();
            }
        }
    }
}

本文是我初次寫部落格，如有不好之處，請多多指教。若文章有疑問之處，可以留言一起討論。