SpringSecurity身份认证原理解析

public class AuthenticationExample {
    private static AuthenticationManager am = new SampleAuthenticationManager();
    public static void main(String[] args) throws IOException {
        BufferedReader in = new BufferedReader(new InputStreamReader(System.in));
        while (true) {
            System.out.println("please enter your username:");
            String name = in.readLine();
            System.out.println("please enter your password:");
            String password = null;
            password = in.readLine();
            try {
                // 封装认证信息，未认证通过
                UsernamePasswordAuthenticationToken request = new UsernamePasswordAuthenticationToken(name, password);
                // 认证逻辑
                Authentication result = am.authenticate(request);
                //当前线程绑定认证信息
                SecurityContextHolder.getContext().setAuthentication(result);
                break;
            } catch (AuthenticationException e) {
                System.out.println("Authentication failed: " + e.getMessage());
            }
        }
    }
    static class SampleAuthenticationManager implements AuthenticationManager {
        static final List<GrantedAuthority> AUTHORITIES = new ArrayList<GrantedAuthority>();
        static {
            AUTHORITIES.add(new SimpleGrantedAuthority("ROLE_USER"));
        }
        @Override
        public Authentication authenticate(Authentication authentication) throws AuthenticationException {
            // 判断条件，用户名和密码是否相同
            if (authentication.getName().equals(authentication.getCredentials())){
                return new UsernamePasswordAuthenticationToken(authentication.getName(),authentication.getCredentials(),AUTHORITIES);
            }
            throw new BadCredentialsException("Bad Credentials");
        }
    }
}

public class UsernamePasswordAuthenticationFilter extends
		AbstractAuthenticationProcessingFilter {
	// ~ Static fields/initializers
	// =====================================================================================
	//从登录请求中获取参数：username,password的名字
	public static final String SPRING_SECURITY_FORM_USERNAME_KEY = "username";
	public static final String SPRING_SECURITY_FORM_PASSWORD_KEY = "password";
	private String usernameParameter = SPRING_SECURITY_FORM_USERNAME_KEY;
	private String passwordParameter = SPRING_SECURITY_FORM_PASSWORD_KEY;
	//默认支持POST登录
	private boolean postOnly = true;
	//默认拦截/login请求，Post方式
	public UsernamePasswordAuthenticationFilter() {
		super(new AntPathRequestMatcher("/login", "POST"));
	}
	// ~ Methods
	// ========================================================================================================
	public Authentication attemptAuthentication(HttpServletRequest request,
			HttpServletResponse response) throws AuthenticationException {
			//判断请求是否是POST
		if (postOnly && !request.getMethod().equals("POST")) {
			throw new AuthenticationServiceException(
					"Authentication method not supported: " + request.getMethod());
		}
		//获取到用户名和密码
		String username = obtainUsername(request);
		String password = obtainPassword(request);
		if (username == null) {
			username = "";
		}
		if (password == null) {
			password = "";
		}
		username = username.trim();
		//用户名和密码封装Token
		UsernamePasswordAuthenticationToken authRequest = new UsernamePasswordAuthenticationToken(
				username, password);
		//设置details属性
		// Allow subclasses to set the "details" property
		setDetails(request, authRequest);
		//调用AuthenticationManager().authenticate进行认证，参数就是Token对象
		return this.getAuthenticationManager().authenticate(authRequest);
	}

public class ProviderManager implements AuthenticationManager, MessageSourceAware,
		InitializingBean {
		...省略...
		//这里authentication 是封装了登录请求的认证参数，
		//即：UsernamePasswordAuthenticationFilter传入的Token对象
	public Authentication authenticate(Authentication authentication)
			throws AuthenticationException {
		Class<? extends Authentication> toTest = authentication.getClass();
		AuthenticationException lastException = null;
		AuthenticationException parentException = null;
		Authentication result = null;
		Authentication parentResult = null;
		boolean debug = logger.isDebugEnabled();
		//找到所有的AuthenticationProvider ，选择合适的进行认证
		for (AuthenticationProvider provider : getProviders()) {
			//是否支持当前认证
			if (!provider.supports(toTest)) {
				continue;
			}
```java
		if (debug) {
			logger.debug("Authentication attempt using "
					+ provider.getClass().getName());
		}
		try {
			//调用provider执行认证
			result = provider.authenticate(authentication);
			if (result != null) {
				copyDetails(authentication, result);
				break;
			}
		}
			...省略...
	}
	...省略...
	//result就是Authentication ，使用的实现类依然是UsernamepasswordAuthenticationToken，
	//封装了认证成功后的用户的认证信息和授权信息
	if (result != null) {
		if (eraseCredentialsAfterAuthentication
			&& (result instanceof CredentialsContainer)) {
		// Authentication is complete. Remove credentials and other secret data
		// from authentication
		//这里在擦除登录密码
		((CredentialsContainer) result).eraseCredentials();
	}
	// If the parent AuthenticationManager was attempted and successful than it will publish an AuthenticationSuccessEvent
	// This check prevents a duplicate AuthenticationSuccessEvent if the parent AuthenticationManager already published it
	if (parentResult == null) {
		//发布事件
		eventPublisher.publishAuthenticationSuccess(result);
	}
	return result;
}

public class DaoAuthenticationProvider extends AbstractUserDetailsAuthenticationProvider {
		//密码编码器
		private PasswordEncoder passwordEncoder;
		//UserDetailsService ，根据用户名加载UserDetails对象，从数据库加载的认证授权信息
		private UserDetailsService userDetailsService;
		//认证检查方法
		protected void additionalAuthenticationChecks(UserDetails userDetails,
			UsernamePasswordAuthenticationToken authentication)
			throws AuthenticationException {
		if (authentication.getCredentials() == null) {
			logger.debug("Authentication failed: no credentials provided");
```java
		throw new BadCredentialsException(messages.getMessage(
				"AbstractUserDetailsAuthenticationProvider.badCredentials",
				"Bad credentials"));
	}
	//获取密码
	String presentedPassword = authentication.getCredentials().toString();
	//通过passwordEncoder比较密码，presentedPassword是用户传入的密码，userDetails.getPassword()是从数据库加载到的密码
	//passwordEncoder编码器不一样比较密码的方式也不一样
	if (!passwordEncoder.matches(presentedPassword, userDetails.getPassword())) {
		logger.debug("Authentication failed: password does not match stored value");
		throw new BadCredentialsException(messages.getMessage(
				"AbstractUserDetailsAuthenticationProvider.badCredentials",
				"Bad credentials"));
	}
}
//检索用户，参数为用户名和Token对象
protected final UserDetails retrieveUser(String username,
		UsernamePasswordAuthenticationToken authentication)
		throws AuthenticationException {
	prepareTimingAttackProtection();
	try {
		//调用UserDetailsService的loadUserByUsername方法，
		//根据用户名检索数据库中的用户，封装成UserDetails 
		UserDetails loadedUser = this.getUserDetailsService().loadUserByUsername(username);
		if (loadedUser == null) {
			throw new InternalAuthenticationServiceException(
					"UserDetailsService returned null, which is an interface contract violation");
		}
		return loadedUser;
	}
	catch (UsernameNotFoundException ex) {
		mitigateAgainstTimingAttack(authentication);
		throw ex;
	}
	catch (InternalAuthenticationServiceException ex) {
		throw ex;
	}
	catch (Exception ex) {
		throw new InternalAuthenticationServiceException(ex.getMessage(), ex);
	}
}
//创建认证成功的认证对象Authentication，使用的实现是UsernamepasswordAuthenticationToken,
//封装了认证成功后的认证信息和授权信息，以及账户的状态等
@Override
protected Authentication createSuccessAuthentication(Object principal,
		Authentication authentication, UserDetails user) {
	boolean upgradeEncoding = this.userDetailsPasswordService != null
			&& this.passwordEncoder.upgradeEncoding(user.getPassword());
	if (upgradeEncoding) {
		String presentedPassword = authentication.getCredentials().toString();
		String newPassword = this.passwordEncoder.encode(presentedPassword);
		user = this.userDetailsPasswordService.updatePassword(user, newPassword);
	}
	return super.createSuccessAuthentication(principal, authentication, user);
}
...省略...

public abstract class AbstractUserDetailsAuthenticationProvider implements
		AuthenticationProvider, InitializingBean, MessageSourceAware {
		//认证逻辑
		public Authentication authenticate(Authentication authentication)
			throws AuthenticationException {
			//得到传入的用户名
			String username = (authentication.getPrincipal() == null) ? "NONE_PROVIDED"
				: authentication.getName();
				//从缓存中得到UserDetails
			boolean cacheWasUsed = true;
			UserDetails user = this.userCache.getUserFromCache(username);
			if (user == null) {
			cacheWasUsed = false;
```java
		try {
			//检索用户，底层会调用UserDetailsService加载数据库中的UserDetails对象，保护认证信息和授权信息
			user = retrieveUser(username,
					(UsernamePasswordAuthenticationToken) authentication);
		}
		catch (UsernameNotFoundException notFound) {
			...省略...
		}
		try {
			//前置检查，主要检查账户是否锁定，账户是否过期等
			preAuthenticationChecks.check(user);
			//比对密码在这个方法里面比对的
			additionalAuthenticationChecks(user,
				(UsernamePasswordAuthenticationToken) authentication);
		}
		catch (AuthenticationException exception) {
		...省略...
		}
		//后置检查
		postAuthenticationChecks.check(user);
		if (!cacheWasUsed) {
			//设置UserDetails缓存
			this.userCache.putUserInCache(user);
		}
		Object principalToReturn = user;
		if (forcePrincipalAsString) {
			principalToReturn = user.getUsername();
		}
		//认证成功，创建Auhentication认证对象
		return createSuccessAuthentication(principalToReturn, authentication, user);
}

认证成功，请求会重新回到UsernamePasswordAuthenticationFilter，然后会通过其父类AbstractAuthenticationProcessingFilter.successfulAuthentication方法将认证对象封装成SecurityContext设置到SecurityContextHolder中
protected void successfulAuthentication(HttpServletRequest request,
			HttpServletResponse response, FilterChain chain, Authentication authResult)
			throws IOException, ServletException {
```java
	if (logger.isDebugEnabled()) {
		logger.debug("Authentication success. Updating SecurityContextHolder to contain: "
				+ authResult);
	}
	//认证成功，吧Authentication 设置到SecurityContextHolder
	SecurityContextHolder.getContext().setAuthentication(authResult);
	//处理记住我业务逻辑
	rememberMeServices.loginSuccess(request, response, authResult);
	// Fire event
	if (this.eventPublisher != null) {
		eventPublisher.publishEvent(new InteractiveAuthenticationSuccessEvent(
				authResult, this.getClass()));
	}
	//重定向登录成功地址
	successHandler.onAuthenticationSuccess(request, response, authResult);
}