shiro在未配置自定義的CredentialsMatcher密碼驗證器時朋其，真正對用戶名密碼進行認證的方法是：
package org.apache.shiro.authc.AbstractAuthenticator.authenticate(AuthenticationToken token)下的doAuthenticate(token)方法，進入此方法：
protected AuthenticationInfo doAuthenticate(AuthenticationToken authenticationToken) throws AuthenticationException {
assertRealmsConfigured();
Collection<Realm> realms = getRealms();
if (realms.size() == 1) {
return doSingleRealmAuthentication(realms.iterator().next(), authenticationToken);
} else {
return doMultiRealmAuthentication(realms, authenticationToken);
}
}
可以看到猪贪，assertRealmsConfigured()方法作用是判斷是否存在realm患雇，如果沒有购披，直接拋出realm配置異常：msg = "Configuration error: No realms have been configured! One or more realms must be " +"present to execute an authentication attempt."
而realm就是在securityManager.setRealm(authRealm())時配置的自定義認證規(guī)則
如果存在realm听哭，即通過doSingleRealmAuthentication(realms.iterator().next(), authenticationToken)或者doMultiRealmAuthentication(realms, authenticationToken)（當配置了多個realm時）對用戶名密碼進行驗證蠢沿，驗證成功伸头，返回認證成功的info，失敗則拋出異常
