[Java] Spring Security登陆流程讲解

private void doFilter(HttpServletRequest request, HttpServletResponse response, FilterChain chain)
    throws IOException, ServletException {
   if (!requiresAuthentication(request, response)) {
    chain.doFilter(request, response);
    return;
   }
   try {
    Authentication authenticationResult = attemptAuthentication(request, response);
    if (authenticationResult == null) {
     // return immediately as subclass has indicated that it hasn't completed
     return;
    }
    this.sessionStrategy.onAuthentication(authenticationResult, request, response);
    // Authentication success
    if (this.continueChainBeforeSuccessfulAuthentication) {
     chain.doFilter(request, response);
    }
    successfulAuthentication(request, response, chain, authenticationResult);
   }
   catch (InternalAuthenticationServiceException failed) {
    this.logger.error("An internal error occurred while trying to authenticate the user.", failed);
    unsuccessfulAuthentication(request, response, failed);
   }
   catch (AuthenticationException ex) {
    // Authentication failed
    unsuccessfulAuthentication(request, response, ex);
   }
}

public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response)
    throws AuthenticationException {
   if (this.postOnly && !request.getMethod().equals("POST")) {
    throw new AuthenticationServiceException("Authentication method not supported: " + request.getMethod());
   }
   String username = obtainUsername(request);
   username = (username != null) ? username : "";
   username = username.trim();
   String password = obtainPassword(request);
   password = (password != null) ? password : "";
   UsernamePasswordAuthenticationToken authRequest = new UsernamePasswordAuthenticationToken(username, password);
   // Allow subclasses to set the "details" property
   setDetails(request, authRequest);
   return this.getAuthenticationManager().authenticate(authRequest);
}

@Nullable
protected String obtainPassword(HttpServletRequest request) {
   return request.getParameter(this.passwordParameter);
}
 
@Nullable
protected String obtainUsername(HttpServletRequest request) {
   return request.getParameter(this.usernameParameter);
}

public WebAuthenticationDetails(HttpServletRequest request) {
   this.remoteAddress = request.getRemoteAddr();
   HttpSession session = request.getSession(false);
   this.sessionId = (session != null) ? session.getId() : null;
}

@Override
public Authentication authenticate(Authentication authentication) throws AuthenticationException {
   //获取Authentication的运行时类
   Class<? extends Authentication> toTest = authentication.getClass();
   AuthenticationException lastException = null;
   AuthenticationException parentException = null;
   Authentication result = null;
   Authentication parentResult = null;
   int currentPosition = 0;
   int size = this.providers.size();
   
   for (AuthenticationProvider provider : getProviders()) {
     //判断是否支持处理该类别的provider
    if (!provider.supports(toTest)) {
     continue;
    }
    if (logger.isTraceEnabled()) {
     logger.trace(LogMessage.format("Authenticating request with %s (%d/%d)",
         provider.getClass().getSimpleName(), ++currentPosition, size));
    }
    try {
      //获取用户的信息
     result = provider.authenticate(authentication);
     if (result != null) {
      copyDetails(authentication, result);
      break;
     }
    }
    catch (AccountStatusException | InternalAuthenticationServiceException ex) {
     prepareException(ex, authentication);
     // SEC-546: Avoid polling additional providers if auth failure is due to
     // invalid account status
     throw ex;
    }
    catch (AuthenticationException ex) {
     lastException = ex;
    }
   }
   //不支持的话跳出循环再次执行
   if (result == null && this.parent != null) {
    // Allow the parent to try.
    try {
     parentResult = this.parent.authenticate(authentication);
     result = parentResult;
    }
    catch (ProviderNotFoundException ex) {
     // ignore as we will throw below if no other exception occurred prior to
     // calling parent and the parent
     // may throw ProviderNotFound even though a provider in the child already
     // handled the request
    }
    catch (AuthenticationException ex) {
     parentException = ex;
     lastException = ex;
    }
   }
   if (result != null) {
     //擦除用户的凭证 也就是密码
    if (this.eraseCredentialsAfterAuthentication && (result instanceof CredentialsContainer)) {
     // Authentication is complete. Remove credentials and other secret data
     // from authentication
     ((CredentialsContainer) result).eraseCredentials();
    }
    // If the parent AuthenticationManager was attempted and successful then it
    // will publish an AuthenticationSuccessEvent
    // This check prevents a duplicate AuthenticationSuccessEvent if the parent
    // AuthenticationManager already published it
    if (parentResult == null) {
      //公示登陆成功
     this.eventPublisher.publishAuthenticationSuccess(result);
    }
 
    return result;
   }
 
   // Parent was null, or didn't authenticate (or throw an exception).
   if (lastException == null) {
    lastException = new ProviderNotFoundException(this.messages.getMessage("ProviderManager.providerNotFound",
      new Object[] { toTest.getName() }, "No AuthenticationProvider found for {0}"));
   }
   // If the parent AuthenticationManager was attempted and failed then it will
   // publish an AbstractAuthenticationFailureEvent
   // This check prevents a duplicate AbstractAuthenticationFailureEvent if the
   // parent AuthenticationManager already published it
   if (parentException == null) {
    prepareException(lastException, authentication);
   }
   throw lastException;
}