SecurityUtils

public static Subject getSubject() {

        Subject subject = ThreadContext.getSubject();

        if (subject == null) {

            subject = (new Subject.Builder()).buildSubject();

            ThreadContext.bind(subject);

        }

        return subject;

    }

ThreadContext

public static Subject getSubject() {

        return (Subject) get(SUBJECT_KEY);

    }

public static Object get(Object key) {

        if (log.isTraceEnabled()) {

            String msg = "get() - in thread [" + Thread.currentThread().getName() + "]";

            log.trace(msg);

        }

        Object value = getValue(key);

        if ((value != null) && log.isTraceEnabled()) {

            String msg = "Retrieved value of type [" + value.getClass().getName() + "] for key [" +

                    key + "] " + "bound to thread [" + Thread.currentThread().getName() + "]";

            log.trace(msg);

        }

        return value;

    }

private static final ThreadLocal<Map<Object, Object>> resources = new InheritableThreadLocalMap<Map<Object, Object>>();

private static Object getValue(Object key) {

        Map<Object, Object> perThreadResources = resources.get();

        return perThreadResources != null ? perThreadResources.get(key) : null;

    }

ThreadLocal<T>

public T get() {

        Thread t = Thread.currentThread();

        ThreadLocalMap map = getMap(t);

        if (map != null) {

            ThreadLocalMap.Entry e = map.getEntry(this);

            if (e != null)

                return (T)e.value;

        }

        return setInitialValue();

    }

DelegatingSubject

public void login(AuthenticationToken token) throws AuthenticationException {

        clearRunAsIdentitiesInternal();

        Subject subject = securityManager.login(this, token);

        ......

        this.principals = principals;

        this.authenticated = true;

this.authenticator = new ModularRealmAuthenticator();

public AuthenticationInfo authenticate(AuthenticationToken token) throws AuthenticationException {

        return this.authenticator.authenticate(token);

    }

protected AuthenticationInfo doAuthenticate(AuthenticationToken authenticationToken) throws AuthenticationException {

        assertRealmsConfigured();

        Collection<Realm> realms = getRealms();

        if (realms.size() == ) {

            return doSingleRealmAuthentication(realms.iterator().next(), authenticationToken);

        } else {

            return doMultiRealmAuthentication(realms, authenticationToken);

        }

    }

AuthenticatingSecurityManager

protected void afterRealmsSet() {

        super.afterRealmsSet();

        if (this.authenticator instanceof ModularRealmAuthenticator) {

            ((ModularRealmAuthenticator) this.authenticator).setRealms(getRealms());

        }

    }

 protected AuthenticationInfo doSingleRealmAuthentication(Realm realm, AuthenticationToken token) {

        if (!realm.supports(token)) {

            String msg = "Realm [" + realm + "] does not support authentication token [" +

                    token + "].  Please ensure that the appropriate Realm implementation is " +

                    "configured correctly or that the realm accepts AuthenticationTokens of this type.";

            throw new UnsupportedTokenException(msg);

        }

        AuthenticationInfo info = realm.getAuthenticationInfo(token);

        if (info == null) {

            String msg = "Realm [" + realm + "] was unable to find account data for the " +

                    "submitted AuthenticationToken [" + token + "].";

            throw new UnknownAccountException(msg);

        }

        return info;

    }

public final AuthenticationInfo getAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {

        AuthenticationInfo info = getCachedAuthenticationInfo(token);

        if (info == null) {

            //otherwise not cached, perform the lookup:

            info = doGetAuthenticationInfo(token);//从数据源中获取用户、密码及相应的密码处理

            log.debug("Looked up AuthenticationInfo [{}] from doGetAuthenticationInfo", info);

            if (token != null && info != null) {

                cacheAuthenticationInfoIfPossible(token, info);

            }

        } else {

            log.debug("Using cached authentication info [{}] to perform credentials matching.", info);

        }

        if (info != null) {

            assertCredentialsMatch(token, info);//进行数据源获取的密码和登录页面获取密码的比对

        } else {

            log.debug("No AuthenticationInfo found for submitted AuthenticationToken [{}].  Returning null.", token);

        }

        return info;

    }

protected void assertCredentialsMatch(AuthenticationToken token, AuthenticationInfo info) throws AuthenticationException {

        CredentialsMatcher cm = getCredentialsMatcher();

        if (cm != null) {

            if (!cm.doCredentialsMatch(token, info)) {

                //not successful - throw an exception to indicate this:

                String msg = "Submitted credentials for token [" + token + "] did not match the expected credentials.";

                throw new IncorrectCredentialsException(msg);

            }

        } else {

            throw new AuthenticationException("A CredentialsMatcher must be configured in order to verify " +

                    "credentials during authentication.  If you do not wish for credentials to be examined, you " +

                    "can configure an " + AllowAllCredentialsMatcher.class.getName() + " instance.");

        }

    }

<bean id="myRealm" class="org.tarena.shiro.realm.MyRealm">

        <property name="credentialsMatcher" >

            <bean class="org.apache.shiro.authc.credential.HashedCredentialsMatcher">

                <property name="hashAlgorithmName" value="MD5"></property>

                <property name="hashIterations" value=""></property>

            </bean>

        </property>

    </bean>