[33]
短点链接: https://nutz.cn/s/c/33
29 回复
@wendal 恩
我用了验证码一直报这个异常。
2015-11-07 17:08:59,837 [http-nio-80-exec-69] DEBUG org.apache.shiro.realm.AuthenticatingRealm - Looked up AuthenticationInfo [null] from doGetAuthenticationInfo
2015-11-07 17:08:59,838 [http-nio-80-exec-69] DEBUG org.apache.shiro.realm.AuthenticatingRealm - No AuthenticationInfo found for submitted AuthenticationToken [org.nutz.integration.shiro.CaptchaUsernamePasswordToken - null, rememberMe=false (198.1.16.12)]. Returning null.
2015-11-07 17:08:59,838 [http-nio-80-exec-69] DEBUG org.apache.shiro.web.servlet.SimpleCookie - Added HttpServletResponse Cookie [rememberMe=deleteMe; Path=/jg; Max-Age=0; Expires=Fri, 06-Nov-2015 09:08:59 GMT]
@wendal 看样子不是。。。
Looked up AuthenticationInfo [null] from doGetAuthenticationInfo 为什么找不到凭证呢
那句log应该是这个方法打印的:
org.apache.shiro.realm.AuthenticatingRealm.getAuthenticationInfo
public final AuthenticationInfo getAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
AuthenticationInfo info = getCachedAuthenticationInfo(token);
if (info == null) {
//otherwise not cached, perform the lookup:
info = doGetAuthenticationInfo(token); // 这里是关键, NutDaoRealm覆盖了这个方法
log.debug("Looked up AuthenticationInfo [{}] from doGetAuthenticationInfo", info);
if (token != null && info != null) {
cacheAuthenticationInfoIfPossible(token, info);
}
} else {
log.debug("Using cached authentication info [{}] to perform credentials matching.", info);
}
if (info != null) {
assertCredentialsMatch(token, info);
} else {
log.debug("No AuthenticationInfo found for submitted AuthenticationToken [{}]. Returning null.", token);
}
return info;
}
所以, 要不就是你做的NutDaoRealm没覆盖这个doGetAuthenticationInfo方法,要不就是这个方法的确返回了null
这是nutz.cn里面的NutDaoRealm的写法
protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
// TODO 新版shiro插件已经在CaptchaFormAuthenticationFilter判断了,移除多余的验证码判断逻辑
CaptchaUsernamePasswordToken upToken = (CaptchaUsernamePasswordToken) token;
if (Strings.isBlank(upToken.getCaptcha()))
throw new AuthenticationException("验证码不能为空");
String _captcha = Strings.sBlank(SecurityUtils.getSubject().getSession(true).getAttribute(Toolkit.captcha_attr));
if (!upToken.getCaptcha().equalsIgnoreCase(_captcha))
throw new AuthenticationException("验证码错误");
User user = dao().fetch(User.class, Cnd.where("name", "=", upToken.getUsername()));
if (user == null)
return null; // 没这个用户
if (user.isLocked())
throw new LockedAccountException("Account [" + upToken.getUsername() + "] is locked.");
SimpleAccount account = new SimpleAccount(user.getId(), user.getPassword(), getName());
account.setCredentialsSalt(ByteSource.Util.bytes(user.getSalt()));
return account;
}
干掉验证码逻辑的之后的方法
protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
CaptchaUsernamePasswordToken upToken = (CaptchaUsernamePasswordToken) token;
User user = dao().fetch(User.class, Cnd.where("name", "=", upToken.getUsername()));
if (user == null)
return null;
if (user.isLocked())
throw new LockedAccountException("Account [" + upToken.getUsername() + "] is locked.");
SimpleAccount account = new SimpleAccount(user.getId(), user.getPassword(), getName());
account.setCredentialsSalt(ByteSource.Util.bytes(user.getSalt()));
return account;
}
@wendal 终于知道原因了。。。
你nutbook给的user这个对象的用户名是name
然而验证的时候用的username.....
所以一直验证不通过。。。。囧啊
@wendal 是的，你页面和action都是对的
但是User对象里用的是name
所以我没注意。。。能统一一下就好了。
另外~如果集成beetl 这个session怎么用呢？
直接用Httpsession里面有一个默认的me，是用的user的id
即使我覆盖也没用
如果用SecurityUtils.getSubject().getSession().setAttribute("me",user)
好像也没用啊
搞不懂了
前台用${session.me}只能得到id：1
@wendal 已经解决
不过不是因为这个注解的问题。
是因为我是在user/login这个方法里去建立session的
然而这个方法因为被shiro接管了，所以并没有进入过
添加回复
请先登陆