Shiro Shiro Web Support and EnvironmentLoaderListener

Shiro Shiro Web Support

主要参考： http://shiro.apache.org/web.html 还有涛哥的

作为资源控制访问的事情，主要使用在网络后台方面，所以了解了本地的测试之后，了解web方面的还是比较的很有必要的，本文主要讲解如何简单的定义一个web项目，然后简单的了解实现的方式是怎么样的！

配置 shiro.ini 放置在 resource目录下面至于这些配置的到底是什么意思，这个不是我们关注的重点，随便看看就知道了，一会慢慢的深入了就知道了这个到底是啥子意思了。

[main]
#默认是/login.jsp
authc.loginUrl=/login
roles.unauthorizedUrl=/unauthorized
perms.unauthorizedUrl=/unauthorized

logout.redirectUrl=/login

[users]
zhang=123,admin
wang=123

[roles]
admin=user:*,menu:*

[urls]
/logout2=logout
/login=anon
/logout=anon
/unauthorized=anon
/static/**=anon
/authenticated=authc
/role=authc,roles[admin]
/permission=authc,perms["user:create"]

• 1

maven配置

<dependencies>
        <dependency>
            <groupId>junit</groupId>
            <artifactId>junit</artifactId>
            <version>4.9</version>
            <scope>test</scope>
        </dependency>
        <dependency>
            <groupId>commons-logging</groupId>
            <artifactId>commons-logging</artifactId>
            <version>1.1.3</version>
        </dependency>
        <dependency>
            <groupId>org.apache.shiro</groupId>
            <artifactId>shiro-core</artifactId>
            <version>1.2.2</version>
        </dependency>

        <dependency>
            <groupId>org.apache.shiro</groupId>
            <artifactId>shiro-web</artifactId>
            <version>1.2.2</version>
        </dependency>
        <dependency>
            <groupId>mysql</groupId>
            <artifactId>mysql-connector-java</artifactId>
            <version>5.1.25</version>
        </dependency>
        <dependency>
            <groupId>com.alibaba</groupId>
            <artifactId>druid</artifactId>
            <version>0.2.23</version>
        </dependency>

        <dependency>
            <groupId>javax.servlet</groupId>
            <artifactId>javax.servlet-api</artifactId>
            <version>3.0.1</version>
            <scope>provided</scope>
        </dependency>

    </dependencies>

然后就是web项目的重点配置web.xml 
这个加载的顺序listener加载完了才是其他的过滤器啊等等，因为从字面的意思就可以知道了，用于监听容器的启动与关闭事件，所以我们猜，都知道shrio的入口就像之前使用测试文件加载一样从这个Listener中加载配置文件的信息。所以本节研究的重点就是这里啦。

<!--- shiro 1.2 -->
    <listener>
        <listener-class>org.apache.shiro.web.env.EnvironmentLoaderListener</listener-class>
    </listener>
    <context-param>
        <param-name>shiroEnvironmentClass</param-name>
        <param-value>org.apache.shiro.web.env.IniWebEnvironment</param-value><!-- 默认先从/WEB-INF/shiro.ini，如果没有找classpath:shiro.ini -->
    </context-param>
    <context-param>
        <param-name>shiroConfigLocations</param-name>
        <param-value>classpath:shiro.ini</param-value>
    </context-param>
    <filter>
        <filter-name>shiroFilter</filter-name>
        <filter-class>org.apache.shiro.web.servlet.ShiroFilter</filter-class>
    </filter>
    <filter-mapping>
        <filter-name>shiroFilter</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>

EnvironmentLoaderListener

public class EnvironmentLoaderListener extends EnvironmentLoader implements ServletContextListener {

    /**
     * Initializes the Shiro {@code WebEnvironment} and binds it to the {@code ServletContext} at application
     * startup for future reference.
     * @param sce the ServletContextEvent triggered upon application startup
     *创建一个WebEnvironment 绑定在ServletContext上，这里调用的是父类的方法。
     */
    public void contextInitialized(ServletContextEvent sce) {
        initEnvironment(sce.getServletContext());
    }

    /**
     * Destroys any previously created/bound {@code WebEnvironment} instance created by
     * the {@link #contextInitialized(javax.servlet.ServletContextEvent)} method.
     *
     * @param sce the ServletContextEvent triggered upon application shutdown
     */
    public void contextDestroyed(ServletContextEvent sce) {
        destroyEnvironment(sce.getServletContext());
    }
}

其实主要的都是有父类创建的EnvironmentLoader主要就是创建一个WebEnvironment的实例，然后调用初始化的方法！这个类的信息不是很清楚需要了解继承结构。

//主要为了生成管家！
public class EnvironmentLoader {

    /**
     * Servlet Context config param for specifying the {@link WebEnvironment} implementation class to use:
     * WebEnvironment 的实现类，主要负责解析Ini文件，生成管家
     */
    public static final String ENVIRONMENT_CLASS_PARAM = "shiroEnvironmentClass";

    /**
     * Servlet Context config param for the resource path to use for configuring the {@link WebEnvironment} instance:
     * 配置文件的位置，在web.xml中可以指定
     */
    public static final String CONFIG_LOCATIONS_PARAM = "shiroConfigLocations";
    /**
    *唯一的Key放置在ServletContext中
    **/
    public static final String ENVIRONMENT_ATTRIBUTE_KEY =
           EnvironmentLoader.class.getName() + ".ENVIRONMENT_ATTRIBUTE_KEY";

    /**
     * Initializes Shiro's {@link WebEnvironment} instance for the specified {@code ServletContext}
     *加载的起点
     */
    public WebEnvironment initEnvironment(ServletContext servletContext) throws IllegalStateException {
         //比较的严谨
        if (servletContext.getAttribute(ENVIRONMENT_ATTRIBUTE_KEY) != null) {
            throw new IllegalStateException(msg);
        }

        servletContext.log("Initializing Shiro environment");
        log.info("Starting Shiro environment initialization.");

        long startTime = System.currentTimeMillis();

        try {
            //创建这个WebEnvironment,放置在servletContext中，全局共享
            WebEnvironment environment = createEnvironment(servletContext);
            servletContext.setAttribute(ENVIRONMENT_ATTRIBUTE_KEY, environment);
            return environment;
        } catch (RuntimeException ex) {
            log.error("Shiro environment initialization failed", ex);
            servletContext.setAttribute(ENVIRONMENT_ATTRIBUTE_KEY, ex);
            throw ex;
        } catch (Error err) {
            log.error("Shiro environment initialization failed", err);
            servletContext.setAttribute(ENVIRONMENT_ATTRIBUTE_KEY, err);
            throw err;
        }
    }

    /**
     * Return the WebEnvironment implementation class to use, either the default
     * {@link IniWebEnvironment} or a custom class if specified.
     * 可以在配置文件中配置WebEnvironment的实现类，默认为IniWebEnvironment 扩展很好啊！
     * 不过一般都不会改变的，通过反射来创建这个实例
     */
    protected Class<?> determineWebEnvironmentClass(ServletContext servletContext) {
        String className = servletContext.getInitParameter(ENVIRONMENT_CLASS_PARAM);
        if (className != null) {
            try {
                return ClassUtils.forName(className);
            } catch (UnknownClassException ex) {
                throw new ConfigurationException();
            }
        } else {
            return IniWebEnvironment.class;
        }
    }

    /**
     * Instantiates a {@link WebEnvironment} based on the specified ServletContext.
     */
    protected WebEnvironment createEnvironment(ServletContext sc) {

        Class<?> clazz = determineWebEnvironmentClass(sc);//选择CLSS
        if (!MutableWebEnvironment.class.isAssignableFrom(clazz)) {
            throw new ConfigurationException("Custom WebEnvironment class [" + clazz.getName() +
                    "] is not of required type [" + WebEnvironment.class.getName() + "]");
        }

        String configLocations = sc.getInitParameter(CONFIG_LOCATIONS_PARAM);
        boolean configSpecified = StringUtils.hasText(configLocations);

        if (configSpecified && !(ResourceConfigurable.class.isAssignableFrom(clazz))) {
            throw new ConfigurationException(msg);
        }

        MutableWebEnvironment environment = (MutableWebEnvironment)
                               ClassUtils.newInstance(clazz);
                               //反射实例

        environment.setServletContext(sc);

        if (configSpecified && (environment instanceof ResourceConfigurable)) {
            ((ResourceConfigurable) environment).setConfigLocations(configLocations);
             //设置配置文件路径
        }

        customizeEnvironment(environment);//子类可以重写定制

        LifecycleUtils.init(environment);//初始化WebEnvironment，加载配置文件信息

        return environment;
    }

    protected void customizeEnvironment(WebEnvironment environment) {
    }

    /**
     * Destroys the {@link WebEnvironment} for the given servlet context.
     */
    public void destroyEnvironment(ServletContext servletContext) {
        servletContext.log("Cleaning up Shiro Environment");
        try {
            Object environment = servletContext.getAttribute(ENVIRONMENT_ATTRIBUTE_KEY);
            LifecycleUtils.destroy(environment);
        } finally {
            servletContext.removeAttribute(ENVIRONMENT_ATTRIBUTE_KEY);
        }
    }
}

WebEnvironment 继承结构图简单 

复杂继承结构图 

默认的实现是最后一个，就是我们的末端。先把最上面的接口了解清楚之后在一一的进行处了解，慢慢的去理解思想，shiro很喜欢用模板方法，不懂的自己去看看设计模式。

Environment

public interface Environment {

    /**
     * Returns the application's {@code SecurityManager} instance.
     *
     * @return the application's {@code SecurityManager} instance.
     */
    SecurityManager getSecurityManager();
}

NamedObjectEnvironment

public interface NamedObjectEnvironment extends Environment {

    /**
     * 这个接口的意思应该是从一个Map<String,Object>中取一个类型安全的东西！
     * 由于擦除了类型~
     */
    <T> T getObject(String name, Class<T> requiredType) throws RequiredTypeException;
}

WebEnvironment

/**
 * A web-specific {@link Environment} instance, used in web applications.
 *
 * @since 1.2
 */
public interface WebEnvironment extends Environment {

    /**
     * Returns the web application's {@code FilterChainResolver} if one has been configured or {@code null} if one
     * is not available.
     *这里使用了Filter的责任链设计模式，这里是返回一个责任链的解析器，过滤器肯定必须使用涩！
     */
    FilterChainResolver getFilterChainResolver();

    ServletContext getServletContext();

    /**
     * Returns the web application's security manager instance.
     *这个应该和之前的管家类似，增加了一点功能吧！
     */
    WebSecurityManager getWebSecurityManager();
}

//过滤器链是不是和filter很相似！
public interface FilterChainResolver {

    /**
     * Returns the filter chain that should be executed for the given request, or {@code null} if the
     * original chain should be used.
     * <p/>
     * This method allows a implementation to define arbitrary security {@link javax.servlet.Filter Filter}
     * chains for any given request or URL pattern.
     * @param originalChain the original {@code FilterChain} intercepted by the ShiroFilter implementation.
     * @return the filter chain that should be executed for the given request, or {@code null} if the
     *         original chain should be used.
     */
    FilterChain getChain(ServletRequest request, ServletResponse response, FilterChain originalChain);

}
//是否使用Session Http的session
public interface WebSecurityManager extends SecurityManager {

    /**
     * Security information needs to be retained from request to request, so Shiro makes use of a
     * session for this. Typically, a security manager will use the servlet container's HTTP session
     * but custom session implementations, for example based on EhCache, may also be used. This
     * method indicates whether the security manager is using the HTTP session or not.
     *是不是使用Http会话，坑了使用redis或者EhCache之类的缓存服务器
     */
    boolean isHttpSessionMode();
}

MutableWebEnvironment用户放入web环境下的信息，管家啊之类的！

//Mutable 可以变化的，用来注入的信息
public interface MutableWebEnvironment extends WebEnvironment {

    void setFilterChainResolver(FilterChainResolver filterChainResolver);

    void setServletContext(ServletContext servletContext);

    void setWebSecurityManager(WebSecurityManager webSecurityManager);
}

DefaultEnvironment就是把实例的的信息字段放置在找Map中，按照类型安全的获取值！

/**
 * Simple/default {@code Environment} implementation that stores Shiro objects as key-value pairs in a
 * {@link java.util.Map Map} instance.  The key is the object name, the value is the object itself.
 * 将shiro的一些重要的数据放在Map中
 * @since 1.2
 */
public class DefaultEnvironment implements NamedObjectEnvironment, Destroyable {

    public static final String DEFAULT_SECURITY_MANAGER_KEY = "securityManager";
    protected final Map<String, Object> objects;
    private String securityManagerName;
    //线程安全
    public DefaultEnvironment() {
        this(new ConcurrentHashMap<String, Object>());
    }

    /**
     * Creates a new instance with the specified backing map.
     */
    @SuppressWarnings({"unchecked"})
    public DefaultEnvironment(Map<String, ?> seed) {
        this.securityManagerName = DEFAULT_SECURITY_MANAGER_KEY;
        if (seed == null) {
            throw new IllegalArgumentException("Backing map cannot be null.");
        }
        this.objects = (Map<String, Object>) seed;
    }

    public SecurityManager getSecurityManager() throws IllegalStateException {
        SecurityManager securityManager = lookupSecurityManager();
        if (securityManager == null) {

        }
        return securityManager;
    }

    public void setSecurityManager(SecurityManager securityManager) {
        if (securityManager == null) {
            throw new IllegalArgumentException("Null");
        }
        String name = getSecurityManagerName();
        setObject(name, securityManager);
    }

    /**
     * 从Map中找到保存的备份管家的
     */
    protected SecurityManager lookupSecurityManager() {
        String name = getSecurityManagerName();
        return getObject(name, SecurityManager.class);
    }

    public String getSecurityManagerName() {
        return securityManagerName;
    }
    public void setSecurityManagerName(String securityManagerName) {
        this.securityManagerName = securityManagerName;
    }

    /**
     * Returns the live (modifiable) internal objects collection.
     *返回可以修改的objects,因为这个是线程安全的。
     */
    public Map<String,Object> getObjects() {
        return this.objects;
    }
    /**
    *返回类型安全的Map中的值
    **/
    @SuppressWarnings({"unchecked"})
    public <T> T getObject(String name, Class<T> requiredType) throws RequiredTypeException {
        if (name == null) {
            throw new NullPointerException("name parameter cannot be null.");
        }
        if (requiredType == null) {
            throw new NullPointerException("requiredType parameter cannot be null.");
        }
        Object o = this.objects.get(name);
        if (o == null) {
            return null;
        }
        if (!requiredType.isInstance(o)) {
            String msg = "Object named '" + name + "' is not of required type [" + requiredType.getName() + "].";
            throw new RequiredTypeException(msg);
        }
        return (T)o;
    }

    public void setObject(String name, Object instance) {
        if (name == null) {
            throw new NullPointerException();
        }
        if (instance == null) {
            this.objects.remove(name);
        } else {
            this.objects.put(name, instance);
        }
    }
    public void destroy() throws Exception {
        LifecycleUtils.destroy(this.objects.values());
    }
}

• 1

DefaultWebEnvironment 写得分工明确，写的非常的好的！而且各种的接口设计也是非常的合理的。各种需要可以制定的成员变量全部都是处理为接口的！

/**
 * Default {@link WebEnvironment} implementation based on a backing {@link Map} instance.
 *主要是基于祖上的Map进行处理的，这个是Web所以增加了ServletContext 成员变量,分工很明确啊
 *然后返回Web性质的管家进行处理断言！很严谨哦，还有设置过滤链
 * @since 1.2
 */
public class DefaultWebEnvironment extends DefaultEnvironment implements MutableWebEnvironment {

    private static final String DEFAULT_FILTER_CHAIN_RESOLVER_NAME = "filterChainResolver";

    private ServletContext servletContext;

    public DefaultWebEnvironment() {
        super();
    }

    public FilterChainResolver getFilterChainResolver() {
        return getObject(DEFAULT_FILTER_CHAIN_RESOLVER_NAME, FilterChainResolver.class);
    }

    public void setFilterChainResolver(FilterChainResolver filterChainResolver) {
        setObject(DEFAULT_FILTER_CHAIN_RESOLVER_NAME, filterChainResolver);
    }

    @Override
    public SecurityManager getSecurityManager() throws IllegalStateException {
        return getWebSecurityManager();
    }

    @Override
    public void setSecurityManager(SecurityManager securityManager) {
        assertWebSecurityManager(securityManager);
        super.setSecurityManager(securityManager);
    }
    //写的非常的严谨
    public WebSecurityManager getWebSecurityManager() {
        SecurityManager sm = super.getSecurityManager();
        assertWebSecurityManager(sm);
        return (WebSecurityManager)sm;
    }

    public void setWebSecurityManager(WebSecurityManager wsm) {
        super.setSecurityManager(wsm);
    }

    private void assertWebSecurityManager(SecurityManager sm) {
        if (!(sm instanceof WebSecurityManager)) {
            String msg = "SecurityManager instance must be a " + WebSecurityManager.class.getName() + " instance.";
            throw new IllegalStateException(msg);
        }
    }

    public ServletContext getServletContext() {
        return this.servletContext;
    }

    public void setServletContext(ServletContext servletContext) {
        this.servletContext = servletContext;
    }
}

• 1

ResourceConfigurable这个接口更加的直接，设置配置文件的路径，是不是感觉越来越近了，找到熟悉的感觉了。

public interface ResourceConfigurable {

    /**
     * Convenience method that accepts a comma-delimited string of config locations (resource paths).
     *
     * @param locations comma-delimited list of config locations (resource paths).
     */
    void setConfigLocations(String locations);

    /**
     * Sets the configuration locations (resource paths) that will be used to configure the instance.
     *
     * @param locations the configuration locations (resource paths) that will be used to configure the instance.
     */
    void setConfigLocations(String[] locations);

}

• 1

ResourceBasedWebEnvironment 就是设置一个路径的位置而已！

/**
 * Abstract implementation for {@code WebEnvironment}s that can be initialized via resource paths (config files).
 *一个类的单一任务的原则，在这里体现的淋淋尽致
 * @since 1.2
 */
public abstract class ResourceBasedWebEnvironment extends DefaultWebEnvironment implements ResourceConfigurable {

    private String[] configLocations;

    public String[] getConfigLocations() {
        return configLocations;
    }

    public void setConfigLocations(String locations) {
        if (!StringUtils.hasText(locations)) {
            throw new IllegalArgumentException("Null/empty locations argument not allowed.");
        }
        //使用,进行分割的Utils方法
        String[] arr = StringUtils.split(locations);
        setConfigLocations(arr);
    }

    public void setConfigLocations(String[] configLocations) {
        this.configLocations = configLocations;
    }

}

IniWebEnvironment这里主要瑟得到管家和过滤的实例信息。 
1. 查找并加载 shiro.ini 配置文件，首先从自身成员变量里查找，然后从 web.xml 中查找，然后从 /WEB-INF 下查找，然后从 classpath 下查找，若均未找到，则直接报错。 
2. 当找到了 ini 配置文件后就开始解析，此时构造了一个 Bean 容器（相当于一个轻量级的 IOC 容器），最终的目标是为了创建 WebSecurityManager 对象与 FilterChainResolver 对象，创建过程使用了 Abstract Factory 模式：

/**
 * {@link WebEnvironment} implementation configured by an {@link Ini} instance or {@code Ini} resource locations.
 *
 * @since 1.2
 */
public class IniWebEnvironment extends ResourceBasedWebEnvironment implements Initializable, Destroyable {

    public static final String DEFAULT_WEB_INI_RESOURCE_PATH = "/WEB-INF/shiro.ini";
    /**
     * The Ini that configures this WebEnvironment instance.
     */
    private Ini ini;

    /**
     * 这个方法被调用了之后和之前的一样的去创建，Ini类信息，然后在Configure() 创建一个工厂，
     *得到工厂getInstance一样的
     * Initializes this instance by resolving any potential (explicit or resource-configured) {@link Ini}
     * configuration and calling {@link #configure() configure} for actual instance configuration.
     */
    public void init() {
        Ini ini = getIni();

        String[] configLocations = getConfigLocations();
        if (log.isWarnEnabled() && !CollectionUtils.isEmpty(ini) &&
                configLocations != null && configLocations.length > 0) {
                    IniWebEnvironment.class.getName());
        }
        //先去实例的，没有再去找配置的，没有再去找默认的
        if (CollectionUtils.isEmpty(ini)) {
            log.debug("Checking any specified config locations.");
            ini = getSpecifiedIni(configLocations);
        }

        if (CollectionUtils.isEmpty(ini)) {
            log.debug(" Trying default config locations.");
            ini = getDefaultIni();
        }
        //这里很正常吧，没有配置的异常！
        if (CollectionUtils.isEmpty(ini)) {
            String msg = "not found or discovered to be empty/unconfigured.";
            throw new ConfigurationException(msg);
        }
        setIni(ini);
        configure();//这里是寻找工厂的
    }

    protected void configure() {
        //之前定义的Map哦！，是用来处理一些信息的
        this.objects.clear();
        //先去创建工厂，然后得到实例~
        WebSecurityManager securityManager = createWebSecurityManager();
        setWebSecurityManager(securityManager);
        //创建过滤链
        FilterChainResolver resolver = createFilterChainResolver();
        if (resolver != null) {
            setFilterChainResolver(resolver);
        }
    }

    protected Ini getSpecifiedIni(String[] configLocations) throws ConfigurationException {

        Ini ini = null;

        if (configLocations != null && configLocations.length > 0) {

            if (configLocations.length > 1) {
            }

            //required, as it is user specified:
            ini = createIni(configLocations[0], true);
        }

        return ini;
    }

    protected Ini getDefaultIni() {

        Ini ini = null;

        String[] configLocations = getDefaultConfigLocations();
        if (configLocations != null) {
            for (String location : configLocations) {
                ini = createIni(location, false);
                    break;
                }
            }
        }

        return ini;
    }

    protected Ini createIni(String configLocation, boolean required) throws ConfigurationException {

        Ini ini = null;

        if (configLocation != null) {
            ini = convertPathToIni(configLocation, required);
        }
        if (required && CollectionUtils.isEmpty(ini)) {

        }

        return ini;
    }
    //这里得到？从配置中得到信息后怎么处理？
    protected FilterChainResolver createFilterChainResolver() {

        FilterChainResolver resolver = null;
        Ini ini = getIni();
        if (!CollectionUtils.isEmpty(ini)) {
            //only create a resolver if the 'filters' or 'urls' sections are defined:
            Ini.Section urls = ini.getSection(IniFilterChainResolverFactory.URLS);
            Ini.Section filters = ini.getSection(IniFilterChainResolverFactory.FILTERS);
            if (!CollectionUtils.isEmpty(urls) || !CollectionUtils.isEmpty(filters)) {
                //either the urls section or the filters section was defined.  Go ahead and create the resolver:
                IniFilterChainResolverFactory factory = new IniFilterChainResolverFactory(ini, this.objects);
                resolver = factory.getInstance();
            }
        }

        return resolver;
    }
    //创建工厂，然后在得到实例！和之前的差不多，这个getbean有点可以哦！
    protected WebSecurityManager createWebSecurityManager() {
        WebIniSecurityManagerFactory factory;
        Ini ini = getIni();
        if (CollectionUtils.isEmpty(ini)) {
            factory = new WebIniSecurityManagerFactory();
        } else {
            factory = new WebIniSecurityManagerFactory(ini);
        }

        WebSecurityManager wsm = (WebSecurityManager)factory.getInstance();

        //SHIRO-306 - get beans after they've been created (the call was before the factory.getInstance() call,
        //which always returned null.
        Map<String, ?> beans = factory.getBeans();
        if (!CollectionUtils.isEmpty(beans)) {
            this.objects.putAll(beans);
        }

        return wsm;
    }

    protected String[] getDefaultConfigLocations() {
        return new String[]{
                DEFAULT_WEB_INI_RESOURCE_PATH,
                IniFactorySupport.DEFAULT_INI_RESOURCE_PATH
        };
    }

    private Ini convertPathToIni(String path, boolean required) {

        //TODO - this logic is ugly - it'd be ideal if we had a Resource API to polymorphically encaspulate this behavior

        Ini ini = null;

        if (StringUtils.hasText(path)) {
            InputStream is = null;

            //SHIRO-178: Check for servlet context resource and not only resource paths:
            if (!ResourceUtils.hasResourcePrefix(path)) {
                is = getServletContextResourceStream(path);
            } else {
                try {
                    is = ResourceUtils.getInputStreamForPath(path);
                } catch (IOException e) {
                    if (required) {
                        throw new ConfigurationException(e);
                    } else {
                        if (log.isDebugEnabled()) {
                            log.debug("Unable to load optional path '" + path + "'.", e);
                        }
                    }
                }
            }
            if (is != null) {
                ini = new Ini();
                ini.load(is);
            } else {
                if (required) {
                    throw new ConfigurationException("Unable to load resource path '" + path + "'");
                }
            }
        }

        return ini;
    }
    //TODO - this logic is ugly - it'd be ideal if we had a Resource API to polymorphically encaspulate this behavior
    private InputStream getServletContextResourceStream(String path) {
        InputStream is = null;

        path = WebUtils.normalize(path);
        ServletContext sc = getServletContext();
        if (sc != null) {
            is = sc.getResourceAsStream(path);
        }

        return is;
    }

    /**
     * Returns the {@code Ini} instance reflecting this WebEnvironment's configuration.
     */
    public Ini getIni() {
        return this.ini;
    }
    public void setIni(Ini ini) {
        this.ini = ini;
    }
}

看看继承图 我记得之前我们的工厂的图没有WebIniSecurityManagerFactory 和 IniFilterChainResolverFactory 
这个一定看到过的！ 
WebSecurityManager wsm = (WebSecurityManager)factory.getInstance();

看这个创造的顺序慢慢的一步步的处理~

 protected void configure() {

        this.objects.clear();

        WebSecurityManager securityManager = createWebSecurityManager();
        setWebSecurityManager(securityManager);

        FilterChainResolver resolver = createFilterChainResolver();
        if (resolver != null) {
            setFilterChainResolver(resolver);
        }
    }

其中有两个 Factory 需要关注： 
- WebIniSecurityManagerFactory 用于创建 WebSecurityManager。 
- IniFilterChainResolverFactory 用于创建 FilterChainResolver。 
通过以上分析，相信 EnvironmentLoaderListener 已经不再神秘了，无非就是在容器启动时创建 WebEnvironment 对象，并由该对象来读取 Shiro 配置文件，创建WebSecurityManager 与 FilterChainResolver 对象，它们都在后面将要出现的 ShiroFilter 中起到了重要作用。 
从 web.xml 中同样可以得知，ShiroFilter 是整个 Shiro 框架的门面，因为它拦截了所有的请求，后面是需要 Authentication（认证）还是需要 Authorization（授权）都由它说了算。