SpringSecurity基础-认证原理

publicclassSecurityContextPersistenceFilterextendsGenericFilterBean {
  ...省略...
publicvoiddoFilter(ServletRequestreq, ServletResponseres, FilterChainchain) throwsIOException, ServletException {
  ...省略部分代码...
HttpRequestResponseHolderholder=newHttpRequestResponseHolder(request,
response);
//从SecurityContextRepository获取到SecurityContext SecurityContextcontextBeforeChainExecution=repo.loadContext(holder);
try {
//把 securityContext设置到SecurityContextHolder，如果没认证通过，这个SecurtyContext就是空的SecurityContextHolder.setContext(contextBeforeChainExecution);
//调用后面的filter，比如掉用usernamepasswordAuthenticationFilter实现认证chain.doFilter(holder.getRequest(), holder.getResponse());
    }
finally {
//如果认证通过了，这里可以从SecurityContextHolder.getContext();中获取到SecurityContextSecurityContextcontextAfterChainExecution=SecurityContextHolder                .getContext();
// Crucial removal of SecurityContextHolder contents - do this before anything// else.//删除SecurityContextHolder中的SecurityContext SecurityContextHolder.clearContext();
//把SecurityContext 存储到SecurityContextRepositoryrepo.saveContext(contextAfterChainExecution, holder.getRequest(),
holder.getResponse());
request.removeAttribute(FILTER_APPLIED);
if (debug) {
logger.debug("SecurityContextHolder now cleared, as request processing completed");
        }
    }
...省略...

publicclassUsernamePasswordAuthenticationFilterextendsAbstractAuthenticationProcessingFilter {
// ~ Static fields/initializers// =====================================================================================//从登录请求中获取参数：username,password的名字publicstaticfinalStringSPRING_SECURITY_FORM_USERNAME_KEY="username";
publicstaticfinalStringSPRING_SECURITY_FORM_PASSWORD_KEY="password";
privateStringusernameParameter=SPRING_SECURITY_FORM_USERNAME_KEY;
privateStringpasswordParameter=SPRING_SECURITY_FORM_PASSWORD_KEY;
//默认支持POST登录privatebooleanpostOnly=true;
//默认拦截/login请求，Post方式publicUsernamePasswordAuthenticationFilter() {
super(newAntPathRequestMatcher("/login", "POST"));
    }
// ~ Methods// ========================================================================================================publicAuthenticationattemptAuthentication(HttpServletRequestrequest,
HttpServletResponseresponse) throwsAuthenticationException {
//判断请求是否是POSTif (postOnly&&!request.getMethod().equals("POST")) {
thrownewAuthenticationServiceException(
"Authentication method not supported: "+request.getMethod());
        }
//获取到用户名和密码Stringusername=obtainUsername(request);
Stringpassword=obtainPassword(request);
if (username==null) {
username="";
        }
if (password==null) {
password="";
        }
username=username.trim();
//用户名和密码封装TokenUsernamePasswordAuthenticationTokenauthRequest=newUsernamePasswordAuthenticationToken(
username, password);
//设置details属性// Allow subclasses to set the "details" propertysetDetails(request, authRequest);
//调用AuthenticationManager().authenticate进行认证，参数就是Token对象returnthis.getAuthenticationManager().authenticate(authRequest);
    }

publicclassProviderManagerimplementsAuthenticationManager, MessageSourceAware,
InitializingBean {
        ...省略...
//这里authentication 是封装了登录请求的认证参数，//即：UsernamePasswordAuthenticationFilter传入的Token对象publicAuthenticationauthenticate(Authenticationauthentication)
throwsAuthenticationException {
Class<?extendsAuthentication>toTest=authentication.getClass();
AuthenticationExceptionlastException=null;
AuthenticationExceptionparentException=null;
Authenticationresult=null;
AuthenticationparentResult=null;
booleandebug=logger.isDebugEnabled();
//找到所有的AuthenticationProvider ，选择合适的进行认证for (AuthenticationProviderprovider : getProviders()) {
//是否支持当前认证if (!provider.supports(toTest)) {
continue;
            }
if (debug) {
logger.debug("Authentication attempt using "+provider.getClass().getName());
            }
try {
//调用provider执行认证result=provider.authenticate(authentication);
if (result!=null) {
copyDetails(authentication, result);
break;
                }
            }
                ...省略...
        }
        ...省略...
//result就是Authentication ，使用的实现类依然是UsernamepasswordAuthenticationToken，//封装了认证成功后的用户的认证信息和授权信息if (result!=null) {
if (eraseCredentialsAfterAuthentication&& (resultinstanceofCredentialsContainer)) {
// Authentication is complete. Remove credentials and other secret data// from authentication//这里在擦除登录密码            ((CredentialsContainer) result).eraseCredentials();
        }
// If the parent AuthenticationManager was attempted and successful than it will publish an AuthenticationSuccessEvent// This check prevents a duplicate AuthenticationSuccessEvent if the parent AuthenticationManager already published itif (parentResult==null) {
//发布事件eventPublisher.publishAuthenticationSuccess(result);
        }
returnresult;
    }

publicclassDaoAuthenticationProviderextendsAbstractUserDetailsAuthenticationProvider {
//密码编码器privatePasswordEncoderpasswordEncoder;
//UserDetailsService ，根据用户名加载UserDetails对象，从数据库加载的认证授权信息privateUserDetailsServiceuserDetailsService;
//认证检查方法protectedvoidadditionalAuthenticationChecks(UserDetailsuserDetails,
UsernamePasswordAuthenticationTokenauthentication)
throwsAuthenticationException {
if (authentication.getCredentials() ==null) {
logger.debug("Authentication failed: no credentials provided");
thrownewBadCredentialsException(messages.getMessage(
"AbstractUserDetailsAuthenticationProvider.badCredentials",
"Bad credentials"));
        }
//获取密码StringpresentedPassword=authentication.getCredentials().toString();
//通过passwordEncoder比较密码，presentedPassword是用户传入的密码，userDetails.getPassword()是从数据库加载到的密码//passwordEncoder编码器不一样比较密码的方式也不一样if (!passwordEncoder.matches(presentedPassword, userDetails.getPassword())) {
logger.debug("Authentication failed: password does not match stored value");
thrownewBadCredentialsException(messages.getMessage(
"AbstractUserDetailsAuthenticationProvider.badCredentials",
"Bad credentials"));
        }
    }
//检索用户，参数为用户名和Token对象protectedfinalUserDetailsretrieveUser(Stringusername,
UsernamePasswordAuthenticationTokenauthentication)
throwsAuthenticationException {
prepareTimingAttackProtection();
try {
//调用UserDetailsService的loadUserByUsername方法，//根据用户名检索数据库中的用户，封装成UserDetails UserDetailsloadedUser=this.getUserDetailsService().loadUserByUsername(username);
if (loadedUser==null) {
thrownewInternalAuthenticationServiceException(
"UserDetailsService returned null, which is an interface contract violation");
            }
returnloadedUser;
        }
catch (UsernameNotFoundExceptionex) {
mitigateAgainstTimingAttack(authentication);
throwex;
        }
catch (InternalAuthenticationServiceExceptionex) {
throwex;
        }
catch (Exceptionex) {
thrownewInternalAuthenticationServiceException(ex.getMessage(), ex);
        }
    }
//创建认证成功的认证对象Authentication，使用的实现是UsernamepasswordAuthenticationToken,//封装了认证成功后的认证信息和授权信息，以及账户的状态等@OverrideprotectedAuthenticationcreateSuccessAuthentication(Objectprincipal,
Authenticationauthentication, UserDetailsuser) {
booleanupgradeEncoding=this.userDetailsPasswordService!=null&&this.passwordEncoder.upgradeEncoding(user.getPassword());
if (upgradeEncoding) {
StringpresentedPassword=authentication.getCredentials().toString();
StringnewPassword=this.passwordEncoder.encode(presentedPassword);
user=this.userDetailsPasswordService.updatePassword(user, newPassword);
        }
returnsuper.createSuccessAuthentication(principal, authentication, user);
    }
    ...省略...

publicabstractclassAbstractUserDetailsAuthenticationProviderimplementsAuthenticationProvider, InitializingBean, MessageSourceAware {
//认证逻辑publicAuthenticationauthenticate(Authenticationauthentication)
throwsAuthenticationException {
//得到传入的用户名Stringusername= (authentication.getPrincipal() ==null) ?"NONE_PROVIDED"                : authentication.getName();
//从缓存中得到UserDetailsbooleancacheWasUsed=true;
UserDetailsuser=this.userCache.getUserFromCache(username);
if (user==null) {
cacheWasUsed=false;
try {
//检索用户，底层会调用UserDetailsService加载数据库中的UserDetails对象，保护认证信息和授权信息user=retrieveUser(username,
                        (UsernamePasswordAuthenticationToken) authentication);
            }
catch (UsernameNotFoundExceptionnotFound) {
                ...省略...
            }
try {
//前置检查，主要检查账户是否锁定，账户是否过期等preAuthenticationChecks.check(user);
//比对密码在这个方法里面比对的additionalAuthenticationChecks(user,
                    (UsernamePasswordAuthenticationToken) authentication);
            }
catch (AuthenticationExceptionexception) {
            ...省略...
            }
//后置检查postAuthenticationChecks.check(user);
if (!cacheWasUsed) {
//设置UserDetails缓存this.userCache.putUserInCache(user);
            }
ObjectprincipalToReturn=user;
if (forcePrincipalAsString) {
principalToReturn=user.getUsername();
            }
//认证成功，创建Auhentication认证对象returncreateSuccessAuthentication(principalToReturn, authentication, user);
}

protectedvoidsuccessfulAuthentication(HttpServletRequestrequest,
HttpServletResponseresponse, FilterChainchain, AuthenticationauthResult)
throwsIOException, ServletException {
if (logger.isDebugEnabled()) {
logger.debug("Authentication success. Updating SecurityContextHolder to contain: "+authResult);
        }
//认证成功，吧Authentication 设置到SecurityContextHolderSecurityContextHolder.getContext().setAuthentication(authResult);
//处理记住我业务逻辑rememberMeServices.loginSuccess(request, response, authResult);
// Fire eventif (this.eventPublisher!=null) {
eventPublisher.publishEvent(newInteractiveAuthenticationSuccessEvent(
authResult, this.getClass()));
        }
//重定向登录成功地址successHandler.onAuthenticationSuccess(request, response, authResult);
    }