Spring security （一）架构框架-Component、Service、Filter分析

Object principal = SecurityContextHolder.getContext().getAuthentication().getPrincipal(); Object principal = SecurityContextHolder.getContext().getAuthentication().getPrincipal();
   if (principal instanceof UserDetails) {      
        String username = ((UserDetails)principal).getUsername();
   } else {
        String username = principal.toString();
   }
复制代码

public interface Authentication extends Principal, Serializable { 
    //权限信息列表,默认GrantedAuthority接口的一些实现类
    Collection<? extends GrantedAuthority> getAuthorities(); 
    //密码信息
    Object getCredentials();
    //细节信息，web应用中的实现接口通常为 WebAuthenticationDetails，它记录了访问者的ip地址和sessionId的值
    Object getDetails();
    //通常返回值为UserDetails实现类
    Object getPrincipal();
    boolean isAuthenticated();
    void setAuthenticated(boolean var1) throws IllegalArgumentException;
}
复制代码

public interface UserDetails extends Serializable {
     Collection<? extends GrantedAuthority> getAuthorities();
     String getPassword();
     String getUsername();
     boolean isAccountNonExpired();
     boolean isAccountNonLocked();
     boolean isCredentialsNonExpired();
     boolean isEnabled();
}
复制代码

public Authentication authenticate(Authentication authentication)
    throws AuthenticationException {
  Class<? extends Authentication> toTest = authentication.getClass();
  AuthenticationException lastException = null;
  Authentication result = null;
  //AuthenticationProvider列表依次认证
  for (AuthenticationProvider provider : getProviders()) {
    if (!provider.supports(toTest)) {
      continue;
    }
    try {
        //每个AuthenticationProvider进行认证
      result = provider.authenticate(authentication)
      if (result != null) {
        copyDetails(authentication, result);
        break;
      }
    }
    ....
    catch (AuthenticationException e) {
      lastException = e;
    }
  }
    //进行父类AuthenticationProvider进行认证
  if (result == null && parent != null) {
    // Allow the parent to try.
    try {
      result = parent.authenticate(authentication);
    }
    catch (AuthenticationException e) {
      lastException = e;
    }
  }
     // 如果有Authentication信息，则直接返回
  if (result != null) {
    if (eraseCredentialsAfterAuthentication
        && (result instanceof CredentialsContainer)) {
        //清除密码
      ((CredentialsContainer) result).eraseCredentials();
    }
    //发布登录成功事件
    eventPublisher.publishAuthenticationSuccess(result);
    return result;
  }
        //如果都没认证成功，抛出异常
  if (lastException == null) {
    lastException = new ProviderNotFoundException(messages.getMessage(
        "ProviderManager.providerNotFound",
        new Object[] { toTest.getName() },
        "No AuthenticationProvider found for {0}"));
  }
  prepareException(lastException, authentication);
  throw lastException;
    }  
复制代码

UserDetails loadUserByUsername(String username) throws UsernameNotFoundException;  
复制代码

public class CustomUserService implements UserDetailsService {
 @Autowired
 //用户mapper
 private UserInfoMapper userInfoMapper;
 @Autowired
 //用户权限mapper
 private PermissionInfoMapper permissionInfoMapper;
 @Override
 public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
    UserInfoDTO userInfo = userInfoMapper.getUserInfoByUserName(username);
    if (userInfo != null) {
        List<PermissionInfoDTO> permissionInfoDTOS = permissionInfoMapper.findByAdminUserId(userInfo.getId());
        List<GrantedAuthority> grantedAuthorityList = new ArrayList<>();
        //组装权限GrantedAuthority object
        for (PermissionInfoDTO permissionInfoDTO : permissionInfoDTOS) {
            if (permissionInfoDTO != null && permissionInfoDTO.getPermissionName() != null) {
                GrantedAuthority grantedAuthority = new SimpleGrantedAuthority(
                        permissionInfoDTO.getPermissionName());
                grantedAuthorityList.add(grantedAuthority);
            }
        }
        //返回用户信息
        return new User(userInfo.getUserName(), userInfo.getPasswaord(), grantedAuthorityList);
    }else {
        //抛出用户不存在异常
        throw new UsernameNotFoundException("admin" + username + "do not exist");
      }
    }
}   
复制代码

//访问控制决策
  void decide(Authentication authentication, Object secureObject,Collection<ConfigAttribute> attrs) 
        throws AccessDeniedException;
  //是否支持处理传递的ConfigAttribute
  boolean supports(ConfigAttribute attribute);
  //确认class是否为AccessDecisionManager
  boolean supports(Class clazz);
复制代码

Collection<ConfigAttribute> getAttributes(Object object)
    throws IllegalArgumentException;
Collection<ConfigAttribute> getAllConfigAttributes();
boolean supports(Class<?> clazz);
复制代码

public class MyFilterSecurityMetadataSource implements FilterInvocationSecurityMetadataSource {
    public List<ConfigAttribute> getAttributes(Object object) {
        FilterInvocation fi = (FilterInvocation) object;
        String url = fi.getRequestUrl();
        String httpMethod = fi.getRequest().getMethod();
        List<ConfigAttribute> attributes = new ArrayList<ConfigAttribute>();
        // Lookup your database (or other source) using this information and populate the
        // list of attributes
        return attributes;
    }
    public Collection<ConfigAttribute> getAllConfigAttributes() {
        return null;
    }
    public boolean supports(Class<?> clazz) {
        return FilterInvocation.class.isAssignableFrom(clazz);
    }
}
复制代码

public interface PasswordEncoder {
    //密码加密
    String encode(CharSequence rawPassword);
    //密码配对
    boolean matches(CharSequence rawPassword, String encodedPassword);
} 
复制代码

public void invoke(FilterInvocation fi) throws IOException, ServletException {
  if ((fi.getRequest() != null)
      && (fi.getRequest().getAttribute(FILTER_APPLIED) != null)
      && observeOncePerRequest) {
    fi.getChain().doFilter(fi.getRequest(), fi.getResponse());
  }
  else {
    // first time this request being called, so perform security checking
    if (fi.getRequest() != null && observeOncePerRequest) {
      fi.getRequest().setAttribute(FILTER_APPLIED, Boolean.TRUE);
    }
        //回调其继承的抽象类AbstractSecurityInterceptor的方法
    InterceptorStatusToken token = super.beforeInvocation(fi);
    try {
      fi.getChain().doFilter(fi.getRequest(), fi.getResponse());
    }
    finally {
      super.finallyInvocation(token);
    }
    super.afterInvocation(token, null);
  }
}
复制代码

protected InterceptorStatusToken beforeInvocation(Object object) {
  ....
  //获取所有访问权限（url-role）属性列表（已定义在数据库或者其他地方）
  Collection<ConfigAttribute> attributes = this.obtainSecurityMetadataSource()
      .getAttributes(object);
  ....
  //获取该用户访问信息（包括url，访问权限）
  Authentication authenticated = authenticateIfRequired();
  // Attempt authorization
  try {
      //进行授权访问
    this.accessDecisionManager.decide(authenticated, object, attributes);
  }catch
  ....
}
复制代码

public Authentication attemptAuthentication(HttpServletRequest request,
    HttpServletResponse response) throws AuthenticationException {
     //获取表单中的用户名和密码
     String username = obtainUsername(request);
     String password = obtainPassword(request);
     ...
     username = username.trim();
     //组装成username+password形式的token
     UsernamePasswordAuthenticationToken authRequest = new UsernamePasswordAuthenticationToken(
     username, password);
     // Allow subclasses to set the "details" property
     setDetails(request, authRequest);
     //交给内部的AuthenticationManager去认证，并返回认证信息
     return this.getAuthenticationManager().authenticate(authRequest);
}   
复制代码

public class AnonymousAuthenticationFilter extends GenericFilterBean implements
  InitializingBean {
  ...
  public AnonymousAuthenticationFilter(String key) {
      this(key, "anonymousUser", AuthorityUtils.createAuthorityList("ROLE_ANONYMOUS"));
    }
        ...
        public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain)
    throws IOException, ServletException {
      if (SecurityContextHolder.getContext().getAuthentication() == null) {
        //创建匿名登录Authentication的信息
        SecurityContextHolder.getContext().setAuthentication(
            createAuthentication((HttpServletRequest) req));
            ...
      }
      chain.doFilter(req, res);
    }
    //创建匿名登录Authentication的信息方法
    protected Authentication createAuthentication(HttpServletRequest request) {
      AnonymousAuthenticationToken auth = new AnonymousAuthenticationToken(key,
      principal, authorities);
      auth.setDetails(authenticationDetailsSource.buildDetails(request));
      return auth;
    }
}
复制代码