shiro密码加盐加密登录失败

Bertha 。 2022-05-28 01:26 244阅读 0赞

使用shiro做权限校验时报错，发现登录不上，报错

java.lang.IllegalArgumentException: Illegal hexadecimal character H at index 0
        at org.apache.shiro.codec.Hex.toDigit(Hex.java:156) ~[shiro-core-1.4.0.jar:1.4.0]
        at org.apache.shiro.codec.Hex.decode(Hex.java:135) ~[shiro-core-1.4.0.jar:1.4.0]
        at org.apache.shiro.codec.Hex.decode(Hex.java:107) ~[shiro-core-1.4.0.jar:1.4.0]
        at org.apache.shiro.codec.Hex.decode(Hex.java:95) ~[shiro-core-1.4.0.jar:1.4.0]
        at org.apache.shiro.authc.credential.HashedCredentialsMatcher.getCredentials(HashedCredentialsMatcher.java:353) ~[shiro-core-1.4.0.jar:1.4.0]
        at org.apache.shiro.authc.credential.HashedCredentialsMatcher.doCredentialsMatch(HashedCredentialsMatcher.java:380) ~[shiro-core-1.4.0.jar:1.4.0]
        at org.apache.shiro.realm.AuthenticatingRealm.assertCredentialsMatch(AuthenticatingRealm.java:600) ~[shiro-core-1.4.0.jar:1.4.0]
        at org.apache.shiro.realm.AuthenticatingRealm.getAuthenticationInfo(AuthenticatingRealm.java:581) ~[shiro-core-1.4.0.jar:1.4.0]
        at org.apache.shiro.authc.pam.ModularRealmAuthenticator.doSingleRealmAuthentication(ModularRealmAuthenticator.java:180) ~[shiro-core-1.4.0.jar:1.4.0]
        at org.apache.shiro.authc.pam.ModularRealmAuthenticator.doAuthenticate(ModularRealmAuthenticator.java:267) ~[shiro-core-1.4.0.jar:1.4.0]
        at org.apache.shiro.authc.AbstractAuthenticator.authenticate(AbstractAuthenticator.java:198) ~[shiro-core-1.4.0.jar:1.4.0]
        at org.apache.shiro.mgt.AuthenticatingSecurityManager.authenticate(AuthenticatingSecurityManager.java:106) [shiro-core-1.4.0.jar:1.4.0]
        at org.apache.shiro.mgt.DefaultSecurityManager.login(DefaultSecurityManager.java:274) [shiro-core-1.4.0.jar:1.4.0]
        at org.apache.shiro.subject.support.DelegatingSubject.login(DelegatingSubject.java:260)

报错不是密码不对，未知账户或者账户锁定异常，而是未知错误

// 生成盐
            RandomNumberGenerator rng = new SecureRandomNumberGenerator();
            ByteSource salt = rng.nextBytes();
            // 将盐插入数据库
            user.setSalt(salt.toBase64());
            // 生成加密后的密码
            String hashedPasswordBase64 = new Sha256Hash(user.getPassword(), salt, 1024).toBase64();// 按base64方式加密，加密1024次--这里是重点
            user.setPassword(hashedPasswordBase64);

这是realm里实现的方法，重点在于加盐；从数据库取出的盐，要重新变回ByteSource类型，加入登录校验。因为数据库不能存ByteSource类型，所以在注册时需要转换成字符串，现在登录校验再转换回来，出错就在于这里的转换过程，和密码的加密解密过程。

protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
            // UsernamePasswordToken对象用来存放提交的登录信息
            UsernamePasswordToken upt = (UsernamePasswordToken) token;
    
            // 查出是否有此用户
            String username_upt = upt.getUsername();
            User user = userService.findByNameAndValid(username_upt);
    
            if (user != null) {
                ByteSource bytes = ByteSource.Util.bytes(Base64.base64ToByteArray(user.getSalt()));
                SimpleAuthenticationInfo info = new SimpleAuthenticationInfo(user.getName(), user.getPassword(), bytes, getName());
                return info;
            }
            return null;
        }

查看报错地方shiro的源码，  
回头看出错栈：  
![shiro登录报错信息][shiro]  
看源代码

protected Object getCredentials(AuthenticationInfo info) {
            Object credentials = info.getCredentials();
    
            byte[] storedBytes = toBytes(credentials);
    
            if (credentials instanceof String || credentials instanceof char[]) {
                //account.credentials were a char[] or String, so
                //we need to do text decoding first:
                if (isStoredCredentialsHexEncoded()) {     // #1
                    storedBytes = Hex.decode(storedBytes); // 报错信息指向这一行
                } else {
                    storedBytes = Base64.decode(storedBytes);
                }
            }
            AbstractHash hash = newHashInstance();
            hash.setBytes(storedBytes);
            return hash;
        }

结合报错信息说Illegal hexadecimal character，显然是由于解码时格式错了，shiro源码执行的这一行storedBytes = Hex.decode(storedBytes);而不是storedBytes = Base64.decode(storedBytes);  
可我源代码写的是用base64加的密，为什么解密时用的hex呢。  
查看\#1处的方法isStoredCredentialsHexEncoded()

/** * Returns {@code true} if the system's stored credential hash is Hex encoded, {@code false} if it * is Base64 encoded. * <p/> * Default value is {@code true} for convenience - all of Shiro's {@link Hash Hash#toString()} * implementations return Hex encoded values by default, making this class's use with those implementations * easier. * * @return {@code true} if the system's stored credential hash is Hex encoded, {@code false} if it * is Base64 encoded. Default is {@code true} */
        public boolean isStoredCredentialsHexEncoded() {
            return storedCredentialsHexEncoded;
        }

注释说如果credential 哈希是Hex 编码的话为true，base64的话为false，所以修改自定义的realm类实现

public AuthRealm() {
            setName("AuthRealm");       //This name must match the name in the User class's getPrincipals() method
            HashedCredentialsMatcher hashedCredentialsMatcher = new HashedCredentialsMatcher();
            hashedCredentialsMatcher.setHashAlgorithmName("SHA-256");
            hashedCredentialsMatcher.setHashIterations(1024);
            hashedCredentialsMatcher.setStoredCredentialsHexEncoded(false); // 这一行决定hex还是base64
            setCredentialsMatcher(hashedCredentialsMatcher);
        }

重新测试的话，测试通过。

ps：好久没有写博客，懒了。。。但是不写的话很多用过的东西再用就又忘了，又要重新看源码和文档，降低了效率，回头得把该记录的东西记下来。这次其实遇到挺多坑的，先在这里记上，回头一一补全。  
我用的spring boot，使用java config配置shiro尝试很多东西才让它跑起来，回头我把详细配置单开一篇写上，不过我这也是东拼西凑凑出来的，每个人情况不一样，别人的配置我用不了，我的配置你们也未必能用，总之做个参考。  
回头也写写shiro基本怎么用，登录，授权等等

[shiro]: /images/20220528/25f1f15ba28041c287c07c4f06b2fc35.png