Spring Security到底在哪里进行密码方式认证

àì夳堔傛蜴生んèń 2021-07-24 16:24 777阅读 0赞

**一 Spring Security比较好的教程**

[http://www.spring4all.com/article/428][http_www.spring4all.com_article_428]

**二 基于数据库的密码认证**

[http://www.spring4all.com/article/420][http_www.spring4all.com_article_420]

**三 该项目github地址**

[https://github.com/cakin24/spring-security-demos][https_github.com_cakin24_spring-security-demos]

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2NoZW5ncWl1bWluZw_size_16_color_FFFFFF_t_70][]

**四 先演示项目，再讲解原理**

1 按照 [https://github.com/cakin24/spring-security-demos/tree/master/00%20-%20%E6%B3%A8%E5%86%8C%E7%99%BB%E5%BD%95%EF%BC%88%E6%95%B0%E6%8D%AE%E5%BA%93%EF%BC%89][https_github.com_cakin24_spring-security-demos_tree_master_00_20-_20_E6_B3_A8_E5_86_8C_E7_99_BB_E5_BD_95_EF_BC_88_E6_95_B0_E6_8D_AE_E5_BA_93_EF_BC_89]的使用手册先将环境搭建起来

2 启动项目

3 注册用户

[http://localhost:8080/register][http_localhost_8080_register]

用户名：admin

密码：admin

注册后数据库中的数据

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2NoZW5ncWl1bWluZw_size_16_color_FFFFFF_t_70 1][]

4 用刚注册的用户去登录

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2NoZW5ncWl1bWluZw_size_16_color_FFFFFF_t_70 2][]

登录可以成功。

**五 原理解释**

到底是在Spring Security哪一块进行的密码验证呢？

其实主要是两个用户数据获取和一个比较。

第一个用户数据获取：从浏览器输入的用户和密码，用户名和密码会传递到Spring Security内部。

第二个用户数据获取：根据用户名从数据库获得用户详情。

一个比较：将前面两个数据获取进行比较，匹配则通过验证，否则验证不通过。

两个用户数据获取：[http://www.spring4all.com/article/420][http_www.spring4all.com_article_420] 这篇博客写的很清楚

下面看看是哪里进行的密码比较

1 /spring-security-core-5.1.4.RELEASE-sources.jar!/org/springframework/security/authentication/dao/AbstractUserDetailsAuthenticationProvider.java

public Authentication authenticate(Authentication authentication)   // 重点关注这个函数，不重要先略去
          throws AuthenticationException {
    
       ......
       try {
          preAuthenticationChecks.check(user);
          // 重点看这个地方，additionalAuthenticationChecks这个函数会被DaoAuthenticationProvider实现。所以我们要看看DaoAuthenticationProvider的additionalAuthenticationChecks函数实现
          additionalAuthenticationChecks(user,(UsernamePasswordAuthenticationToken) authentication);         
       }
       catch (AuthenticationException exception) {
          if (cacheWasUsed) {
             // There was a problem, so try again after checking
             // we're using latest data (i.e. not from the cache)
             cacheWasUsed = false;
             user = retrieveUser(username,
                   (UsernamePasswordAuthenticationToken) authentication);
             preAuthenticationChecks.check(user);
             additionalAuthenticationChecks(user,
                   (UsernamePasswordAuthenticationToken) authentication);
          }
          else {
             throw exception;
          }
       }
    
    
       postAuthenticationChecks.check(user);
    
    
      ......
    
       return createSuccessAuthentication(principalToReturn, authentication, user);
    }

2 /spring-security-core-5.1.4.RELEASE-sources.jar!/org/springframework/security/authentication/dao/DaoAuthenticationProvider.java

protected void additionalAuthenticationChecks(UserDetails userDetails,
          UsernamePasswordAuthenticationToken authentication)
          throws AuthenticationException {
       if (authentication.getCredentials() == null) {
          logger.debug("Authentication failed: no credentials provided");
    
    
          throw new BadCredentialsException(messages.getMessage(
                "AbstractUserDetailsAuthenticationProvider.badCredentials",
                "Bad credentials"));
       }
    
    
       String presentedPassword = authentication.getCredentials().toString();
       // 密码比较就在这个地方，前面这个是用户输入的密码，后面这个是数据库存的密码，一致则通过
       if (!passwordEncoder.matches(presentedPassword, userDetails.getPassword())) {
          logger.debug("Authentication failed: password does not match stored value");
    
    
          throw new BadCredentialsException(messages.getMessage(
                "AbstractUserDetailsAuthenticationProvider.badCredentials",
                "Bad credentials"));
       }
    }

通过这两步分析，应该很清楚了吧。

[http_www.spring4all.com_article_428]: http://www.spring4all.com/article/428
[http_www.spring4all.com_article_420]: http://www.spring4all.com/article/420
[https_github.com_cakin24_spring-security-demos]: https://github.com/cakin24/spring-security-demos
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2NoZW5ncWl1bWluZw_size_16_color_FFFFFF_t_70]: /images/20210724/4ac7766a276343fe921dcd7dc2161c56.png
[https_github.com_cakin24_spring-security-demos_tree_master_00_20-_20_E6_B3_A8_E5_86_8C_E7_99_BB_E5_BD_95_EF_BC_88_E6_95_B0_E6_8D_AE_E5_BA_93_EF_BC_89]: https://github.com/cakin24/spring-security-demos/tree/master/00%20-%20%E6%B3%A8%E5%86%8C%E7%99%BB%E5%BD%95%EF%BC%88%E6%95%B0%E6%8D%AE%E5%BA%93%EF%BC%89
[http_localhost_8080_register]: http://localhost:8080/register
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2NoZW5ncWl1bWluZw_size_16_color_FFFFFF_t_70 1]: /images/20210724/b0fa8e2a1441443d9b2091b8ca12a456.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2NoZW5ncWl1bWluZw_size_16_color_FFFFFF_t_70 2]: /images/20210724/593b2715648e431ca4f57648dcbc0497.png