@wendal FormAuthenticationFilter

此类如下:

public class AuthenticationFilter extends FormAuthenticationFilter {

    private static final Log log = Logs.get();

    protected ShopDao shopDao;
    
    protected ShopClerkDao shopClerkDao;
    
    protected ShopClerkHandoverDao shopClerkHandoverDao;
    

    protected SysLogService sysLogService;

    @Override
    protected boolean onLoginSuccess(AuthenticationToken token,
                                     Subject subject,
                                     ServletRequest request,
                                     ServletResponse response)
            throws Exception {
        if (log.isDebugEnabled()) {
            log.debugf("Login success.Will load store info for user id [%s]",
                       subject.getPrincipal());
        }
      
        ShopClerk clerk = shopClerkDao().fetch(Cnd.where(ShopClerk.USER_ID, "=", subject.getPrincipal()));
        
        if (clerk != null) {
            Session session = subject.getSession();
          
            session.setAttribute(ShopClerk.CLERK_ID, clerk.getClerk_id());
            session.setAttribute(ShopClerk.CLERK_NAME, clerk.getClerk_name());
            session.setAttribute(ShopClerk.SHOP_ID, clerk.getShop_id());
            session.setAttribute(ShopClerk.SHOP_NAME, clerk.getShop_name());
            
            String ymd = getYMD();
            Cnd cnd = Cnd.where(ShopClerkHandover.CREATE_TIME, ">", ymd+" 05:00:00");
            cnd.desc(ShopClerkHandover.CREATE_TIME);
            cnd.and(ShopClerkHandover.CLERK_ID, "=", clerk.getClerk_id());
            cnd.and(ShopClerkHandover.SHOP_ID, "=", clerk.getShop_id());
            ShopClerkHandover handover = shopClerkHandoverDao().fetch(cnd);
            
            if (null == handover) {
            	 ShopClerkHandover over = new ShopClerkHandover();
            	 over.setOndate(BurroKit.current());
            	 over.setClerk_id(clerk.getClerk_id());
            	 over.setClerk_name(clerk.getClerk_name());
            	 over.setShop_id(clerk.getShop_id());
            	 over.setShop_name(clerk.getShop_name());
            	 over.setCreate_time(BurroKit.current());
                 shopClerkHandoverDao().insert(over);
			}
            
            if (null != handover) {
				if (handover.getOutdate() != null) {
					 ShopClerkHandover over = new ShopClerkHandover();
	            	 over.setOndate(BurroKit.current());
	            	 over.setClerk_id(clerk.getClerk_id());
	            	 over.setClerk_name(clerk.getClerk_name());
	            	 over.setShop_id(clerk.getShop_id());
	            	 over.setShop_name(clerk.getShop_name());
	            	 over.setCreate_time(BurroKit.current());
	            	  shopClerkHandoverDao().insert(over);
				}
			}
        }
        
        Shop shop = shopDao().fetch(Cnd.where(Shop.USER_ID, "=", subject.getPrincipal()));
        if (shop != null) {
            Session session = subject.getSession();
            session.setAttribute(NutShiro.SessionKey, subject.getPrincipal());
            session.setAttribute(Shop.SHOP_ID, shop.getShop_id());
            session.setAttribute(Shop.SHOP_NAME, shop.getShop_name());
            session.setAttribute(NutShiro.TokenKey, R.UU16());
        }
        
        SysLog syslog = SysLog.c("aop.after",
                                 AevnService.MEMBER_LOG_TAG,
                                 "me.zouooh.mvc.shiro.UserRealm#doGetAuthenticationInfo",
                                 (int)subject.getPrincipal(),
                                 "用户登录");
        syslog.setLog_ip(BurroKit.getRemoteIp((HttpServletRequest)request));
        sysLogService().async(syslog);
        return super.onLoginSuccess(token, subject, request, response);
    }


    @Override
    protected void setFailureAttribute(ServletRequest request, AuthenticationException ae) {
        String message = ae.getMessage();
        if (ae instanceof IncorrectCredentialsException) {
            message = "密码错误";
        }
        request.setAttribute(getFailureKeyAttribute(), message);
    }

    public SysLogService sysLogService() {
        if (sysLogService == null) {
            sysLogService = Mvcs.ctx().getDefaultIoc().get(SysLogService.class);
        }
        return sysLogService;
    }
    
    public ShopDao shopDao() {
        if (shopDao == null) {
            shopDao = Mvcs.ctx().getDefaultIoc().get(ShopDao.class);
        }
        return shopDao;
    }
    
    public ShopClerkDao shopClerkDao() {
        if (shopClerkDao == null) {
        	shopClerkDao = Mvcs.ctx().getDefaultIoc().get(ShopClerkDao.class);
        }
        return shopClerkDao;
    }
    
    public ShopClerkHandoverDao shopClerkHandoverDao(){
    	 if (shopClerkHandoverDao == null) {
    		 shopClerkHandoverDao = Mvcs.ctx().getDefaultIoc().get(ShopClerkHandoverDao.class);
         }
         return shopClerkHandoverDao;
    }
    
    public String getYMD() {
		Calendar calendar = Times.C(Times.now());
		String ymd = Times.sD(calendar.getTime());
		return ymd;
	}
    
}

感谢大叔指点迷津.
我的理解是: 请求来了,走shiro过滤器,其中走到FormAuthenticationFilter过滤器时如果是登录请求那么就subject.login(),然后间接交给realm认证......真是让我茅塞顿开哇,感谢大叔