SpringSecurity-4-认证流程源码解析

public interface AuthenticationManager {
 Authentication authenticate(Authentication authentication) throws AuthenticationException;
}

public class ProviderManager implements AuthenticationManager, MessageSourceAware, InitializingBean {
 private static final Log logger = LogFactory.getLog(ProviderManager.class);
 private List<AuthenticationProvider> providers = Collections.emptyList();
 @Override
 public Authentication authenticate(Authentication authentication) throws AuthenticationException {
  //获取当前的Authentication的认证类型
        Class<? extends Authentication> toTest = authentication.getClass();
  AuthenticationException lastException = null;
  AuthenticationException parentException = null;
  Authentication result = null;
  Authentication parentResult = null;
  int currentPosition = 0;
  int size = this.providers.size();
        // 迭代认证提供者,不同认证方式有不同提供者，如：用户名密码认证提供者，手机短信认证提供者
  for (AuthenticationProvider provider : getProviders()) {
            // 选取当前认证方式对应的提供者
   if (!provider.supports(toTest)) {
    continue;
   }
   if (logger.isTraceEnabled()) {
    logger.trace(LogMessage.format("Authenticating request with %s (%d/%d)",
      provider.getClass().getSimpleName(), ++currentPosition, size));
   }
   try {
                // 进行认证操作
                // AbstractUserDetailsAuthenticationProvider》DaoAuthenticationProvider
    result = provider.authenticate(authentication);
    if (result != null) {
                    //认证通过的话，将认证结果的details赋值到当前认证对象authentication。然后跳出循环
     copyDetails(authentication, result);
     break;
    }
   }
   catch (AccountStatusException | InternalAuthenticationServiceException ex) {
    prepareException(ex, authentication);
    // SEC-546: Avoid polling additional providers if auth failure is due to
    // invalid account status
    throw ex;
   }
   catch (AuthenticationException ex) {
    lastException = ex;
   }
  }
  if (result == null && this.parent != null) {
   // Allow the parent to try.
   try {
    parentResult = this.parent.authenticate(authentication);
    result = parentResult;
   }
   catch (ProviderNotFoundException ex) {
    // ignore as we will throw below if no other exception occurred prior to
    // calling parent and the parent
    // may throw ProviderNotFound even though a provider in the child already
    // handled the request
   }
   catch (AuthenticationException ex) {
    parentException = ex;
    lastException = ex;
   }
  }
  if (result != null) {
   if (this.eraseCredentialsAfterAuthentication && (result instanceof CredentialsContainer)) {
    // Authentication is complete. Remove credentials and other secret data
    // from authentication
    ((CredentialsContainer) result).eraseCredentials();
   }
   // If the parent AuthenticationManager was attempted and successful then it
   // will publish an AuthenticationSuccessEvent
   // This check prevents a duplicate AuthenticationSuccessEvent if the parent
   // AuthenticationManager already published it
   if (parentResult == null) {
    this.eventPublisher.publishAuthenticationSuccess(result);
   }
   return result;
  }
  // Parent was null, or didn't authenticate (or throw an exception).
  if (lastException == null) {
   lastException = new ProviderNotFoundException(this.messages.getMessage("ProviderManager.providerNotFound",
     new Object[] { toTest.getName() }, "No AuthenticationProvider found for {0}"));
  }
  // If the parent AuthenticationManager was attempted and failed then it will
  // publish an AbstractAuthenticationFailureEvent
  // This check prevents a duplicate AbstractAuthenticationFailureEvent if the
  // parent AuthenticationManager already published it
  if (parentException == null) {
   prepareException(lastException, authentication);
  }
  throw lastException;
 }
 @SuppressWarnings("deprecation")
 private void prepareException(AuthenticationException ex, Authentication auth) {
  this.eventPublisher.publishAuthenticationFailure(ex, auth);
 }
 public List<AuthenticationProvider> getProviders() {
  return this.providers;
 }
}

@Override
public Authentication authenticate(Authentication authentication) throws AuthenticationException {
   //如果authentication不是UsernamePasswordAuthenticationToken类型，则抛出异常
   Assert.isInstanceOf(UsernamePasswordAuthenticationToken.class, authentication,
         () -> this.messages.getMessage("AbstractUserDetailsAuthenticationProvider.onlySupports",
               "Only UsernamePasswordAuthenticationToken is supported"));\
   // 获取用户名
   String username = determineUsername(authentication);
   boolean cacheWasUsed = true;
   //从缓存中获取UserDetails
   UserDetails user = this.userCache.getUserFromCache(username);
   //当缓存中没有UserDetails，则从子类DaoAuthenticationProvider中获取
   if (user == null) {
      cacheWasUsed = false;
      try {
         //子类DaoAuthenticationProvider中实现获取用户信息, 
         // 就是调用对应UserDetailsService#loadUserByUsername
         user = retrieveUser(username, (UsernamePasswordAuthenticationToken) authentication);
      }
      catch (UsernameNotFoundException ex) {
        ...
      }
      ...
   }
   try {
       //前置检查。DefaultPreAuthenticationChecks 检测帐户是否锁定，是否可用，是否过期
      this.preAuthenticationChecks.check(user);
      // 检查密码是否正确
      additionalAuthenticationChecks(user, (UsernamePasswordAuthenticationToken) authentication);
   }
   catch (AuthenticationException ex) {
       // 异常则是重新认证
      if (!cacheWasUsed) {
         throw ex;
      }
      cacheWasUsed = false;
       // 调用 loadUserByUsername 查询登录用户信息
      user = retrieveUser(username, (UsernamePasswordAuthenticationToken) authentication);
      this.preAuthenticationChecks.check(user);
      additionalAuthenticationChecks(user, (UsernamePasswordAuthenticationToken) authentication);
   }
    //后检查。由DefaultPostAuthenticationChecks实现(检测密码是否过期)
   this.postAuthenticationChecks.check(user);
   if (!cacheWasUsed) {//是否放到缓存中
      this.userCache.putUserInCache(user);
   }
   Object principalToReturn = user;
   if (this.forcePrincipalAsString) {
      principalToReturn = user.getUsername();
   }
    //将认证成功用户信息封装成 UsernamePasswordAuthenticationToken 对象并返回
   return createSuccessAuthentication(principalToReturn, authentication, user);
}