【发布时间】：2019-01-04 14:11:51
【问题描述】：
我使用 apache shiro 和 google oauth 和 microsoft 365 oauth 编写了一个身份验证和授权模块。它允许用户使用 google/ms 凭据登录没有问题，但是授权过滤器被调用了很多次。下面是我从单次登录获得的调试日志示例。这么多次授权周期被调用。所以任何人都知道我该如何解决这个问题。
17:39:16.998 [qtp670971910-28] INFO com.hap.Google.GoogleRealm - GoogleRealm: doGetAuthorizationInfo is called!!
17:39:17.105 [qtp670971910-28] INFO com.hap.Google.GoogleRealm - GoogleRealm: doGetAuthorizationInfo is called!!
17:39:17.224 [qtp670971910-28] INFO com.hap.Google.GoogleRealm - GoogleRealm: doGetAuthorizationInfo is called!!
17:39:17.348 [qtp670971910-28] INFO com.hap.Google.GoogleRealm - GoogleRealm: doGetAuthorizationInfo is called!!
17:39:17.408 [qtp670971910-28] INFO com.hap.Google.GoogleRealm - GoogleRealm: doGetAuthorizationInfo is called!!
17:39:17.479 [qtp670971910-28] INFO com.hap.Google.GoogleRealm - GoogleRealm: doGetAuthorizationInfo is called!!
17:39:17.596 [qtp670971910-28] INFO com.hap.Google.GoogleRealm - GoogleRealm: doGetAuthorizationInfo is called!!
17:39:17.713 [qtp670971910-28] INFO com.hap.Google.GoogleRealm - GoogleRealm: doGetAuthorizationInfo is called!!
17:39:17.838 [qtp670971910-28] INFO com.hap.Google.GoogleRealm - GoogleRealm: doGetAuthorizationInfo is called!!
17:39:17.967 [qtp670971910-28] INFO com.hap.Google.GoogleRealm - GoogleRealm: doGetAuthorizationInfo is called!!
17:39:18.087 [qtp670971910-28] INFO com.hap.Google.GoogleRealm - GoogleRealm: doGetAuthorizationInfo is called!!
----------------------------------编辑- --------------------------
我的shiro ini如下所示，
[main]
ssl.enabled = false
authcStrategy = org.apache.shiro.authc.pam.FirstSuccessfulStrategy
securityManager.authenticator.authenticationStrategy = $authcStrategy
GoogleRealm = com.hap.Google.GoogleRealm
#GoogleRealm.permissionsLookupEnabled = true
googleCredentialsMatcher = com.hap.Google.GoogleCredentialsMatcher
GoogleRealm.credentialsMatcher = $googleCredentialsMatcher
Ms365Realm = com.hap.MsOffice365.Ms365Realm
#Ms365Realm.permissionsLookupEnabled = true
Ms365CredentialsMatcher = com.hap.MsOffice365.Ms365CredentialsMatcher
Ms365Realm.credentialsMatcher = $Ms365CredentialsMatcher
securityManager.realms = $GoogleRealm,$Ms365Realm
securityManager.rememberMeManager.cipherKey=kPH+bIxk5D2deZiIxcaaaA==
authc.loginUrl = /views/login-oauth.xhtml
[urls]
#Important
/javax.faces.resource/** = anon
/views/login-oauth.xhtml = authc
/views/access-denied.xhtml = anon
/logout = logout
/views/* = authc
/css/* = anon
/errors/* = anon
#I have to punch a hole for the css files
#/** = authc, roles[admin]
整个代码流程基于sample facebook-shiro example googleRealm 中的 doGetAuthorizationInfo 方法，实际上是从底层数据库（postgres）中获取角色和权限。
@Override
protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {
AuthorizationInfo authorizationInfo = new SimpleAuthorizationInfo();
try {
CommonAuthenticationMethods commonAuth = new CommonAuthenticationMethods();
authorizationInfo = commonAuth.doGetAuthorizationInfo(principals);
LOGGER.info("GoogleRealm: doGetAuthorizationInfo is called!!");
} catch (Exception e) {
LOGGER.debug("GoogleRealm : doGetAuthorizationInfo: exception occurred!! " + e.getMessage());
//throw e;
}
return authorizationInfo;
}
像这样添加了 EnvironmentLoaderListener 和 ShiroFilter。关注link
<listener>
<listener-class>org.apache.shiro.web.env.EnvironmentLoaderListener</listener-class>
</listener>
<filter>
<filter-name>ShiroFilter</filter-name>
<filter-class>org.apache.shiro.web.servlet.ShiroFilter</filter-class>
</filter>
<filter-mapping>
<filter-name>ShiroFilter</filter-name>
<url-pattern>/*</url-pattern>
<dispatcher>REQUEST</dispatcher>
<dispatcher>FORWARD</dispatcher>
<dispatcher>INCLUDE</dispatcher>
<dispatcher>ERROR</dispatcher>
</filter-mapping>
为什么在这里多次调用授权过滤器？
--------------------------编辑-------- -------------------------------------------
<repositories>
<repository>
<snapshots>
<enabled>false</enabled>
</snapshots>
<id>bintray-deluan-maven</id>
<name>bintray</name>
<url>http://dl.bintray.com/deluan/maven</url>
</repository>
</repositories>
似乎在调用shiro:hasAnyRoles 时正在调用授权方法。以上是我如何在 pom.xml 中添加 Deluan 存储库，以便能够在我拥有的 jsf 页面中使用 shiro 标签。我拥有的示例jsf页面之一如下，
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
xmlns:h="http://java.sun.com/jsf/html"
xmlns:f="http://xmlns.jcp.org/jsf/core"
xmlns:c="http://xmlns.jcp.org/jsp/jstl/core"
xmlns:ace="http://www.icefaces.org/icefaces/components"
xmlns:icecore="http://www.icefaces.org/icefaces/core"
xmlns:ui="http://xmlns.jcp.org/jsf/facelets"
xmlns:shiro="http://shiro.apache.org/tags">
<h:head>
<title>Welcome Page</title>
</h:head>
<h:body>
<shiro:hasAnyRoles name="admin,backup-admin,sys-admin">
<h2> Welcome! </h2>
</shiro:hasAnyRoles>
<shiro:hasAnyRoles name="user,admin">
<h2> You too Welcome! </h2>
</shiro:hasAnyRoles>
</h:body>
</html>
这个简单的页面被用作欢迎页面，每次刷新它似乎都会调用 doAuthentication 方法 3 次。当然我在这里做错了什么:(我应该在哪里看的任何指针？
============================已编辑=================== =========
<!-- Shiro Environment Listener -->
<listener>
<listener-class>org.apache.shiro.web.env.EnvironmentLoaderListener</listener-class>
</listener>
<filter>
<filter-name>ShiroFilter</filter-name>
<filter-class>org.apache.shiro.web.servlet.ShiroFilter</filter-class>
</filter>
<filter-mapping>
<filter-name>ShiroFilter</filter-name>
<url-pattern>/*</url-pattern>
<dispatcher>REQUEST</dispatcher>
<dispatcher>FORWARD</dispatcher>
<dispatcher>INCLUDE</dispatcher>
<dispatcher>ERROR</dispatcher>
</filter-mapping>
【问题讨论】：
-
stackoverflow.com/help/how-to-ask 你应该添加你的配置和关于你的应用程序的任何其他细节。
-
对于问题中的信息较少，我深表歉意。我现在添加了一堆信息。