import org.apache.shiro.authz.UnauthenticatedException; //导入依赖的package包/类
@Override
public boolean checkImplies(Permission requiredPermission) {
  if (requiredPermission instanceof ProviderBasedPermission == false) {
    return false;
  }
  ProviderBasedPermission requiredPerm = (ProviderBasedPermission) requiredPermission;
  UserPrincipals user = (UserPrincipals) AuthUtils.getSubject().getSession().getAttribute(UserPrincipals.ATTRIBUTE_KEY);
  if (user == null) {
    throw new UnauthenticatedException("Permission denied: User not logged in: " + requiredPermission);
  }
  PermissionCheckProviderRequest request = PermissionCheckProviderRequest.createGet(
      user.getAlternateIds(), user.getNetworkAddress(), requiredPerm.getPermissionString());
  PermissionCheckProviderResult result = _provider.isPermitted(request);
  result.checkErrors();
  return result.isPermitted(requiredPerm.getPermissionString());
}
 

import org.apache.shiro.authz.UnauthenticatedException; //导入依赖的package包/类
private PermissionCheckProviderResult processAuthenticationError(
    PermissionCheckProviderRequest request, Exception ex) {
  
  String msg = String.format("Bloomberg authentication failure for user: %s IpAddress: %s",
      request.getUserIdBundle(), request.getNetworkAddress());
  if (ex.getCause() == null) {
    s_logger.warn(msg, ex);
    return PermissionCheckProviderResult.ofAuthenticationError(
        "Bloomberg authentication error: Unknown cause: " + ex.getMessage());
  } else if (ex.getCause() instanceof UnauthenticatedException) {
    s_logger.debug(msg);
    return PermissionCheckProviderResult.ofAuthenticationError(
        "Bloomberg authentication failed: " + ex.getCause().getMessage());
  } else {
    s_logger.warn(msg, ex.getCause());
    return PermissionCheckProviderResult.ofAuthenticationError(
        "Bloomberg authentication error: " + ex.getCause().getClass().getName() + ": " + ex.getMessage());
  }
}
 

import org.apache.shiro.authz.UnauthenticatedException; //导入依赖的package包/类
@Test(expectedExceptions = UnauthenticatedException.class)
public void unauthorizedIdentity() {
  SessionProvider sessionProvider = null;
  try {
    BloombergConnector connector = BloombergTestUtils.getBloombergBipeConnector();
    connector.getSessionOptions().setAuthenticationOptions(BloombergConstants.AUTH_APP_PREFIX + "UnknownAppName");
    sessionProvider = new SessionProvider(connector, Lists.newArrayList(BloombergConstants.AUTH_SVC_NAME, BloombergConstants.MKT_DATA_SVC_NAME, BloombergConstants.REF_DATA_SVC_NAME));
    sessionProvider.start();
    BloombergBpipeApplicationUserIdentityProvider provider = new BloombergBpipeApplicationUserIdentityProvider(sessionProvider);

    provider.getIdentity();
  } finally {
    if (sessionProvider != null) {
      sessionProvider.stop();
    }
  }
}
 

import org.apache.shiro.authz.UnauthenticatedException; //导入依赖的package包/类
private void checkSubjectIs(String id) {
    try {
        Subject subject = SecurityUtils.getSubject();
        if (subject.isAuthenticated()) {
            if (id.equals( ((UserInfo)subject.getPrincipal()).getOpenid() ) || subject.hasRole(RegAuthorizationInfo.ADMINSTRATOR_ROLE) ) {
                return;
            } else {
                throw new AuthorizationException("Cannot change credentials for another user");
            }
        } else {
            throw new UnauthenticatedException();
        }
    } catch (UnavailableSecurityManagerException e) {
        // Allow to proceed if no security system is configured
    }
}
 

import org.apache.shiro.authz.UnauthenticatedException; //导入依赖的package包/类
@ExceptionHandler(value = {UnauthenticatedException.class})
public RedirectView unauthenticated(WebRequest request) {
    // @RequiresUser등으로 로그인으로 강제 전환이 이루어질때, 다시 돌아올 위치를 저장.
    if (request instanceof ServletWebRequest) {
        ServletWebRequest swr = (ServletWebRequest) request;
        if (swr.getRequest() != null) {
            // NOTE: ...이거 이외에도 ㅎㅎㅎ 페이지들 jsp으로 그대로 redirect해버림.
            final String s = ObjectUtils.toString(swr.getRequest().getRequestURL());
            if (false == (s.startsWith("/WEB-INF/") && s.endsWith(".jsp"))) {
                LOG.debug(String.format("SAVE REQUEST FOR LOGIN-SUCCESS-REDIRECT = [%s]", swr.getRequest().getRequestURL()));
                WebUtils.saveRequest(swr.getRequest());
            }
        }
    }
    return new RedirectView(String.format("%s/a/error/unauthenticated", WebappPath.getWebappPath()));
}
 

import org.apache.shiro.authz.UnauthenticatedException; //导入依赖的package包/类
@Override
public Object intercept(AnnotationInterceptChain chain, Response response, Request request, RequiresAuthentication annotation) throws Throwable {
    if (!SecurityUtils.getSubject().isAuthenticated()) {
        throw new UnauthenticatedException("The current Subject is not authenticated.  Access denied.");
    }
    return chain.intercept();
}
 

import org.apache.shiro.authz.UnauthenticatedException; //导入依赖的package包/类
@Override
  public Response toResponse(UnauthenticatedException exception) {
ResponseBuilder builder = Response.status(Response.Status.UNAUTHORIZED);
builder.header("WWW-Authenticate", HttpServletRequest.BASIC_AUTH + " realm=\"" + appName + "\"");
  	if (exception.getMessage() != null)
  		builder = builder.entity(exception.getMessage()).type("text/plain");
  	
  	return builder.build();
  }
 

import org.apache.shiro.authz.UnauthenticatedException; //导入依赖的package包/类
/**
 * 没有认证
 * @return
 */
@ExceptionHandler(value = UnauthenticatedException.class)
public ModelAndView authHandler(){
	ModelAndView mv = new ModelAndView();
	mv.setViewName("redirect:/login");
	return mv;
}
 

import org.apache.shiro.authz.UnauthenticatedException; //导入依赖的package包/类
@Override
public Object invoke(MethodInvocation invocation) throws Throwable {
  checkState(initialized);
  Subject subject = subjectProvider.get();
  if (subject.isAuthenticated()) {
    return invocation.proceed();
  } else {
    // This is a special exception that will signal the BasicHttpAuthenticationFilter to send
    // a 401 with a challenge. This is necessary at this layer since we only apply this
    // interceptor to methods that require authentication.
    throw new UnauthenticatedException();
  }
}
 

import org.apache.shiro.authz.UnauthenticatedException; //导入依赖的package包/类
@Override
protected void handleUnauthenticated(
    HttpServletRequest request,
    HttpServletResponse response,
    FilterChain chain) throws IOException, ServletException {

  // Incoming request is unauthenticated, but some RPCs might be okay with that.
  try {
    chain.doFilter(request, response);
  } catch (UnauthenticatedException e) {
    super.handleUnauthenticated(request, response, chain);
  }
}
 

import org.apache.shiro.authz.UnauthenticatedException; //导入依赖的package包/类
@Test
public void testInterceptsUnauthenticatedException() throws ServletException, IOException {
  mockServlet.service(anyObject(HttpServletRequest.class), anyObject(HttpServletResponse.class));
  expectLastCall().andThrow(new UnauthenticatedException());

  replayAndStart();

  ClientResponse clientResponse = getRequestBuilder(PATH).get(ClientResponse.class);

  assertEquals(HttpServletResponse.SC_UNAUTHORIZED, clientResponse.getStatus());
  assertEquals(
      ShiroKerberosAuthenticationFilter.NEGOTIATE,
      clientResponse.getHeaders().getFirst(HttpHeaders.WWW_AUTHENTICATE));
}
 

import org.apache.shiro.authz.UnauthenticatedException; //导入依赖的package包/类
@Test(expected = UnauthenticatedException.class)
public void testInvokeNotAuthenticated() throws Throwable {
  expect(subject.isAuthenticated()).andReturn(false);

  replayAndInitialize();

  interceptor.invoke(methodInvocation);
}
 

import org.apache.shiro.authz.UnauthenticatedException; //导入依赖的package包/类
protected void assertAuthzCheckPossible() throws AuthorizationException {
    if (!hasPrincipals()) {
        String msg = "This subject is anonymous - it does not have any identifying principals and " +
                "authorization operations require an identity to check against.  A Subject instance will " +
                "acquire these identifying principals automatically after a successful login is performed " +
                "be executing " + Subject.class.getName() + ".login(AuthenticationToken) or when 'Remember Me' " +
                "functionality is enabled by the SecurityManager.  This exception can also occur when a " +
                "previously logged-in Subject has logged out which " +
                "makes it anonymous again.  Because an identity is currently not known due to any of these " +
                "conditions, authorization is denied.";
        throw new UnauthenticatedException(msg);
    }
}
 

import org.apache.shiro.authz.UnauthenticatedException; //导入依赖的package包/类
/**
 * Overrides the default behavior to call {@link #onAccessDenied} and swallow the exception if the exception is
 * {@link UnauthenticatedException}.
 */
@Override
protected void cleanup(ServletRequest request, ServletResponse response, Exception existing) throws ServletException, IOException {
    if (existing instanceof UnauthenticatedException || (existing instanceof ServletException && existing.getCause() instanceof UnauthenticatedException))
    {
        try {
            onAccessDenied(request, response);
            existing = null;
        } catch (Exception e) {
            existing = e;
        }
    }
    super.cleanup(request, response, existing);

}
 

import org.apache.shiro.authz.UnauthenticatedException; //导入依赖的package包/类
@Override
public Object intercept(AnnotationInterceptChain chain, Response response, Request request, RequiresGuest annotation) throws Throwable {
    if (SecurityUtils.getSubject().getPrincipal() != null) {
        throw new UnauthenticatedException("Attempting to perform a guest-only operation.  The current Subject is " +
                "not a guest (they have been authenticated or remembered from a previous login).  Access " +
                "denied.");
    }
    return chain.intercept();
}
 

import org.apache.shiro.authz.UnauthenticatedException; //导入依赖的package包/类
@Override
public Object intercept(AnnotationInterceptChain chain, Response response, Request request, RequiresUser annotation) throws Throwable {
    if (SecurityUtils.getSubject().getPrincipal() == null) {
        throw new UnauthenticatedException("Attempting to perform a user-only operation.  The current Subject is " +
                "not a user (they haven't been authenticated or remembered from a previous login).  " +
                "Access denied.");
    }
    return chain.intercept();
}
 

import org.apache.shiro.authz.UnauthenticatedException; //导入依赖的package包/类
@Override
   public void assertAuthorized() throws AuthorizationException {
	 if (getSubject().getPrincipal() != null) {
            throw new UnauthenticatedException("Attempting to perform a guest-only operation.  The current Subject is " +
                    "not a guest (they have been authenticated or remembered from a previous login).  Access " +
                    "denied.");
        }
}
 

import org.apache.shiro.authz.UnauthenticatedException; //导入依赖的package包/类
@Override
public void intercept(Invocation inv) {
    AuthzHandler ah = ShiroKit.getAuthzHandler(inv.getActionKey());
    // 存在访问控制处理器。
    if (ah != null) {
        try {
            // 执行权限检查。
            ah.assertAuthorized();
        } catch (UnauthenticatedException lae) {
            // RequiresGuest，RequiresAuthentication，RequiresUser，未满足时，抛出未经授权的异常。
            // 如果没有进行身份验证，返回HTTP401状态码
            inv.getController().renderError(401);
            return;
        } catch (AuthorizationException ae) {
            // RequiresRoles，RequiresPermissions授权异常
            // 如果没有权限访问对应的资源，返回HTTP状态码403。
            inv.getController().renderError(403);
            return;
        } catch (Exception e) {
            // 出现了异常，应该是没有登录。
            inv.getController().renderError(401);
            return;
        }
    }
    // 执行正常逻辑
    inv.invoke();
}
 

import org.apache.shiro.authz.UnauthenticatedException; //导入依赖的package包/类
@Override
   public void assertAuthorized() throws AuthorizationException {
	if (getSubject().getPrincipal() == null) {
           throw new UnauthenticatedException("Attempting to perform a user-only operation.  The current Subject is " +
                   "not a user (they haven't been authenticated or remembered from a previous login).  " +
                   "Access denied.");
       }
}
 

import org.apache.shiro.authz.UnauthenticatedException; //导入依赖的package包/类
@Override
   public void intercept(Invocation ai) {
	AuthzHandler ah = ShiroKit.getAuthzHandler(ai.getActionKey());
	// 存在访问控制处理器。
	if (ah != null) {
		try {
			// 执行权限检查。
			ah.assertAuthorized();
		} catch (UnauthenticatedException lae) {
			// RequiresGuest，RequiresAuthentication，RequiresUser，未满足时，抛出未经授权的异常。
			// 如果没有进行身份验证，返回HTTP401状态码
			ai.getController().renderError(401);
			return;
		} catch (AuthorizationException ae) {
			// RequiresRoles，RequiresPermissions授权异常
			// 如果没有权限访问对应的资源，返回HTTP状态码403。
			ai.getController().renderError(403);
			return;
		} catch (Exception e) {
			// 出现了异常，应该是没有登录。
			ai.getController().renderError(401);
			return;
		}
	}
	// 执行正常逻辑
	ai.invoke();
}