Spring Security认证器实现过程详解

String username = this.obtainUsername(request);
String password = this.obtainPassword(request);
//创建上下文
UsernamePasswordAuthenticationToken authRequest = new UsernamePasswordAuthenticationToken(username, password);
this.setDetails(request, authRequest);
return this.getAuthenticationManager().authenticate(authRequest);

public UsernamePasswordAuthenticationToken(Object principal,Object credentials){
    super(null);
    this.principal=principal;
    this.credentials=credentials;
    //还没认证
    setAuthenticated(false);
}

//权限利集合
private final Collection<GrantedAuthority> authorities;
//空的集合
public static final List<GrantedAuthority> NO_AUTHORITIES = Collections.emptyList();
//初始化
if (authorities == null) {
    this.authorities = AuthorityUtils.NO_AUTHORITIES;
    return;
}

//认证完成
public UsernamePasswordAuthenticationToken(Object principal, Object credentials,
    Collection<? extends GrantedAuthority> authorities) {
    super(authorities);
    this.principal = principal;
    this.credentials = credentials;
    super.setAuthenticated(true); // must use super, as we override
}

/**
 * Attempts to authenticate the passed {@link Authentication} object, returning a
 * fully populated <code>Authentication</code> object (including granted authorities)
 * if successful.
 **/
public interface AuthenticationManager {
    Authentication authenticate(Authentication authentication)
            throws AuthenticationException;
}

/**
 * Indicates a class can process a specific Authentication 
 **/
public interface AuthenticationProvider {
    Authentication authenticate(Authentication authentication)
            throws AuthenticationException;
    //支不支持特定类型的authentication
    boolean supports(Class<?> authentication);
}

public boolean supports(Class<?> authentication) {
		return (UsernamePasswordAuthenticationToken.class
				.isAssignableFrom(authentication));
}

 Assert.isInstanceOf(UsernamePasswordAuthenticationToken.class, authentication,
     () -> messages.getMessage(
     "AbstractUserDetailsAuthenticationProvider.onlySupports",
     "Only UsernamePasswordAuthenticationToken is supported"));

 user=retrieveUser(username,
     (UsernamePasswordAuthenticationToken)authentication);

UserDetails loadedUser = this.getUserDetailsService().loadUserByUsername(username);

//检验用户合法性
preAuthenticationChecks.check(user);
//校验密码
additionalAuthenticationChecks(user,
(UsernamePasswordAuthenticationToken) authentication);

//账号是否过期
boolean isAccountNonExpired();
//账号被锁定或解锁状态。
boolean isAccountNonLocked();
//密码是否过期
boolean isCredentialsNonExpired();
//是否启用
boolean isEnabled();

 String presentedPassword = authentication.getCredentials().toString();
 if (!passwordEncoder.matches(presentedPassword, userDetails.getPassword())) {
     logger.debug("Authentication failed: password does not match stored value");
     throw new BadCredentialsException(messages.getMessage(
     "AbstractUserDetailsAuthenticationProvider.badCredentials",
     "Bad credentials"));
 }

//当没有从缓存中获取到值时，这个字段会被设置成false
if (!cacheWasUsed) {
			this.userCache.putUserInCache(user);
 }
 //下次进来的时候回去获取
 UserDetails user = this.userCache.getUserFromCache(username);

return createSuccessAuthentication(principalToReturn, authentication, user);

UsernamePasswordAuthenticationToken result = new UsernamePasswordAuthenticationToken(
     principal, authentication.getCredentials(),
     authoritiesMapper.mapAuthorities(user.getAuthorities()));
     result.setDetails(authentication.getDetails());

public UsernamePasswordAuthenticationToken(Object principal, Object credentials,
        Collection<? extends GrantedAuthority> authorities) {
        super(authorities);
        this.principal = principal;
        this.credentials = credentials;
        super.setAuthenticated(true); // must use super, as we override
        }

for (GrantedAuthority a : authorities) {
    if (a == null) {
        throw new IllegalArgumentException(
        "Authorities collection cannot contain any null elements");
    }
}
ArrayList<GrantedAuthority> temp = new ArrayList<>(
authorities.size());
temp.addAll(authorities);
this.authorities = Collections.unmodifiableList(temp);

result = provider.authenticate(authentication);

  if (result != null) {
   	copyDetails(authentication, result);
   	break;
   }

((CredentialsContainer) result).eraseCredentials();