SpringSecurity认证流程详解

public class UsernamePasswordAuthenticationFilter extends AbstractAuthenticationProcessingFilter
  // 登录请求认证
  public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response) throws AuthenticationException {
    // 判断是否是POST请求
    if (this.postOnly && !request.getMethod().equals("POST")) {
      throw new AuthenticationServiceException("Authentication method not supported: " + request.getMethod());
    } else {
      // 获取用户，密码
      String username = this.obtainUsername(request);
      String password = this.obtainPassword(request);
      if (username == null) {
        username = "";
      }

      if (password == null) {
        password = "";
      }

      username = username.trim();
      // 生成Token，
      UsernamePasswordAuthenticationToken authRequest = new UsernamePasswordAuthenticationToken(username, password);
      this.setDetails(request, authRequest);
      // 进一步验证
      return this.getAuthenticationManager().authenticate(authRequest);
    }
  }
}

public UsernamePasswordAuthenticationToken(Object principal, Object credentials) {
  // 设置空的权限
  super((Collection)null);
  this.principal = principal;
  this.credentials = credentials;
  // 设置是否通过了校验
  this.setAuthenticated(false);
}

this.getAuthenticationManager().authenticate(authRequest);

public class ProviderManager implements AuthenticationManager, MessageSourceAware, InitializingBean {
  public Authentication authenticate(Authentication authentication) throws AuthenticationException { 
    Class<? extends Authentication> toTest = authentication.getClass();
    AuthenticationException lastException = null;
    Authentication result = null;
    boolean debug = logger.isDebugEnabled();
    Iterator var6 = this.getProviders().iterator();

    while(var6.hasNext()) {
      AuthenticationProvider provider = (AuthenticationProvider)var6.next();
      // 1.判断是否有provider支持该Authentication
      if (provider.supports(toTest)) {
        // 2. 真正的逻辑判断
        result = provider.authenticate(authentication);
      }
  }
}

public Authentication authenticate(Authentication authentication) throws AuthenticationException { 

  UserDetails user = this.userCache.getUserFromCache(username);
  if (user == null) {
    cacheWasUsed = false;
    // 1.去获取UserDetails
    user = this.retrieveUser(username, (UsernamePasswordAuthenticationToken)authentication);
  }

  try {
    // 2.用户信息预检查
    this.preAuthenticationChecks.check(user);
    // 3.附加的检查（密码检查）
    this.additionalAuthenticationChecks(user, (UsernamePasswordAuthenticationToken)authentication);
  } catch (AuthenticationException var7) {    
  }
  // 4.最后的检查
  this.postAuthenticationChecks.check(user);
  // 5.返回真正的经过认证的Authentication 
  return this.createSuccessAuthentication(principalToReturn, authentication, user);
}

SecurityContextHolder.getContext().setAuthentication(authResult);

/**
 * 获取当前登录的用户
 * @return 完整的Authentication
 */
@GetMapping("/me1")
public Object currentUser() {
  return SecurityContextHolder.getContext().getAuthentication();
}

@GetMapping("/me2")
public Object currentUser(Authentication authentication) {
  return authentication;
}

/**
 * @param userDetails
 * @return 只包含了userDetails
 */
@GetMapping("/me3")
public Object cuurentUser(@AuthenticationPrincipal UserDetails userDetails) {
  return userDetails;
}