Spring Security 认证源码分析

约定不等于承诺〃 2022-11-19 04:14 270阅读 0赞

# 1 简介 #

**描述：** Spring Security 认证是通过UsernamePasswordAuthenticationFilter过滤器实现的，分析该过滤器流程即可。  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM0MTI1OTk5_size_16_color_FFFFFF_t_70]

# 2 源码分析 #

## 2.1 主流程分析 ##

**描述：** UsernamePasswordAuthenticationFilter认证主流程查看父类AbstractAuthenticationProcessingFilter doFilter方法。

public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain)
    			throws IOException, ServletException { 
    			
    		HttpServletRequest request = (HttpServletRequest) req;
    		HttpServletResponse response = (HttpServletResponse) res;
    		
    		//【1】 判断当前请求是否是post，如果不是post那么直接放行
    		if (!requiresAuthentication(request, response)) { 
    			chain.doFilter(request, response);
    
    			return;
    		}
    
    		if (logger.isDebugEnabled()) { 
    			logger.debug("Request is to process authentication");
    		}
    		// 保存认证结果
    		Authentication authResult;
    
    		try { 
    		    //【2】 调用子类UsernamePasswordAuthenticationFilter进行身份认证
    			authResult = attemptAuthentication(request, response);
    			if (authResult == null) { 
    				// return immediately as subclass has indicated that it hasn't completed
    				// authentication
    				return;
    			}
    			//【3】 session策略处理
    			sessionStrategy.onAuthentication(authResult, request, response);
    		}
    		catch (InternalAuthenticationServiceException failed) { 
    			logger.error(
    					"An internal error occurred while trying to authenticate the user.",
    					failed);
    			//【4】 认证失败的处理
    			unsuccessfulAuthentication(request, response, failed);
    
    			return;
    		}
    		catch (AuthenticationException failed) { 
    			// Authentication failed
    		   //【4】 认证失败的处理
    			unsuccessfulAuthentication(request, response, failed);
    
    			return;
    		}
    		
    		//【5】 认证成功的处理
    		// Authentication success
    		if (continueChainBeforeSuccessfulAuthentication) { 
    			chain.doFilter(request, response);
    		}
         
           //【6】 调用认证成功的处理器
    		successfulAuthentication(request, response, chain, authResult);
    	}

## 2.2 认证源码分析 ##

**描述：** 查看UsernamePasswordAuthenticationFilter类attemptAuthentication方法。

### 2.2.1 类属性介绍 ###

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM0MTI1OTk5_size_16_color_FFFFFF_t_70 1]

### 2.2.2 认证流程 ###

public Authentication attemptAuthentication(HttpServletRequest request,
    			HttpServletResponse response) throws AuthenticationException { 
            // 【1】 如果不是post请求那么直接抛异常
    		if (postOnly && !request.getMethod().equals("POST")) { 
    			throw new AuthenticationServiceException(
    					"Authentication method not supported: " + request.getMethod());
    		}
    		
    		// 【2】 获取表单提交的账号、密码
    		String username = obtainUsername(request);
    		String password = obtainPassword(request);
    
    		if (username == null) { 
    			username = "";
    		}
    
    		if (password == null) { 
    			password = "";
    		}
    
    		username = username.trim();
    		
    		// 【3】 分装认证对象Authentication
    		UsernamePasswordAuthenticationToken authRequest = new UsernamePasswordAuthenticationToken(
    				username, password);
    
    		// Allow subclasses to set the "details" property
    		// 【4】 认证对象设置相关属性
    		setDetails(request, authRequest);
    		
    		// 【5】调用ProviderManager类进行认证
    		return this.getAuthenticationManager().authenticate(authRequest);
    	}

**描述：** Authentication接口的实现用于存储主体（用户）信息：

public interface Authentication extends Principal, Serializable { 
    
    
    	/** * 权限 */
    	Collection<? extends GrantedAuthority> getAuthorities();
    
    	/** * 密码 */
    	Object getCredentials();
    
    	/** * 其它信息 */
    	Object getDetails();
    
    	/** * 用户主体信息 */
    	Object getPrincipal();
    
    	/** * 是否被认证 */
    	boolean isAuthenticated();
    
    	/** * 设置认真信息，true认证，false未认证 */
    	void setAuthenticated(boolean isAuthenticated) throws IllegalArgumentException;
    }

### 2.2.3 ProviderManager 认证源码分析 ###

public Authentication authenticate(Authentication authentication)
    			throws AuthenticationException { 
            //【1】 获取认证对象类
    		Class<? extends Authentication> toTest = authentication.getClass();
    		AuthenticationException lastException = null;
    		AuthenticationException parentException = null;
    		Authentication result = null;
    		Authentication parentResult = null;
    		boolean debug = logger.isDebugEnabled();
            //【2】 遍历认证迭代器
    		for (AuthenticationProvider provider : getProviders()) { 
                //不匹配continue
    			if (!provider.supports(toTest)) { 
    				continue;
    			}
    
    			if (debug) { 
    				logger.debug("Authentication attempt using "
    						+ provider.getClass().getName());
    			}
    
    			try { 
    				//【3】 具体认证，会调用用户自定义认证类UserDetailsService进行认证，返回UserDetails对象
    				result = provider.authenticate(authentication);
    				// 认证成功后保存相关信息
    				if (result != null) { 
    					copyDetails(authentication, result);
    					break;
    				}
    			}
    			catch (AccountStatusException | InternalAuthenticationServiceException e) { 
    				prepareException(e, authentication);
    				// SEC-546: Avoid polling additional providers if auth failure is due to
    				// invalid account status
    				throw e;
    			} catch (AuthenticationException e) { 
    				lastException = e;
    			}
    		}
    		
    		//【4】 如果认证结果为空，调用父认证器进行认证
    		if (result == null && parent != null) { 
    			// Allow the parent to try.
    			try { 
    				//认证结果
    				result = parentResult = parent.authenticate(authentication);
    			}
    			catch (ProviderNotFoundException e) { 
    				// ignore as we will throw below if no other exception occurred prior to
    				// calling parent and the parent
    				// may throw ProviderNotFound even though a provider in the child already
    				// handled the request
    			}
    			catch (AuthenticationException e) { 
    				lastException = parentException = e;
    			}
    		}
    
    		if (result != null) { 
    			if (eraseCredentialsAfterAuthentication
    					&& (result instanceof CredentialsContainer)) { 
    				// Authentication is complete. Remove credentials and other secret data
    				// from authentication
    				((CredentialsContainer) result).eraseCredentials();
    			}
    
    			// If the parent AuthenticationManager was attempted and successful than it will publish an AuthenticationSuccessEvent
    			// This check prevents a duplicate AuthenticationSuccessEvent if the parent AuthenticationManager already published it
    			if (parentResult == null) { 
    				eventPublisher.publishAuthenticationSuccess(result);
    			}
    			return result;
    		}
    
    		// Parent was null, or didn't authenticate (or throw an exception).
    
    		if (lastException == null) { 
    			lastException = new ProviderNotFoundException(messages.getMessage(
    					"ProviderManager.providerNotFound",
    					new Object[] {  toTest.getName() },
    					"No AuthenticationProvider found for {0}"));
    		}
    
    		// If the parent AuthenticationManager was attempted and failed than it will publish an AbstractAuthenticationFailureEvent
    		// This check prevents a duplicate AbstractAuthenticationFailureEvent if the parent AuthenticationManager already published it
    		if (parentException == null) { 
    			prepareException(lastException, authentication);
    		}
    
    		throw lastException;
    	}

# 3 认证成功 #

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM0MTI1OTk5_size_16_color_FFFFFF_t_70 2]

protected void successfulAuthentication(HttpServletRequest request,
    			HttpServletResponse response, FilterChain chain, Authentication authResult)
    			throws IOException, ServletException { 
    
    		if (logger.isDebugEnabled()) { 
    			logger.debug("Authentication success. Updating SecurityContextHolder to contain: "
    					+ authResult);
    		}
    		//【1】 认证对象存入Spring Security Cotext 上下文中
    		SecurityContextHolder.getContext().setAuthentication(authResult);
    		
    		//【2】remember(记住我)处理
    		rememberMeServices.loginSuccess(request, response, authResult);
    
    		 //【3】 发布事件
    		// Fire event
    		if (this.eventPublisher != null) { 
    			eventPublisher.publishEvent(new InteractiveAuthenticationSuccessEvent(
    					authResult, this.getClass()));
    		}
    		
    		successHandler.onAuthenticationSuccess(request, response, authResult);
    	}

# 4 Debug #

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM0MTI1OTk5_size_16_color_FFFFFF_t_70 3]  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM0MTI1OTk5_size_16_color_FFFFFF_t_70 4]  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM0MTI1OTk5_size_16_color_FFFFFF_t_70 5]  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM0MTI1OTk5_size_16_color_FFFFFF_t_70 6]  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM0MTI1OTk5_size_16_color_FFFFFF_t_70 7]  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM0MTI1OTk5_size_16_color_FFFFFF_t_70 8]  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM0MTI1OTk5_size_16_color_FFFFFF_t_70 9]  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM0MTI1OTk5_size_16_color_FFFFFF_t_70 10]

[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM0MTI1OTk5_size_16_color_FFFFFF_t_70]: /images/20221022/2cb3f198abf1435a84a5893d3ab87094.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM0MTI1OTk5_size_16_color_FFFFFF_t_70 1]: /images/20221022/34ba6ea824a54ed8889f199edec36592.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM0MTI1OTk5_size_16_color_FFFFFF_t_70 2]: /images/20221022/ad469ed7af1f40f4a546c32f372be4e5.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM0MTI1OTk5_size_16_color_FFFFFF_t_70 3]: /images/20221022/6b7dbeabeeb740c3a8f4a64f6f996b81.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM0MTI1OTk5_size_16_color_FFFFFF_t_70 4]: /images/20221022/bb6f495b5a12475c805b09f22e0846c0.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM0MTI1OTk5_size_16_color_FFFFFF_t_70 5]: /images/20221022/7c30c8da115a423bac3289f518c5a515.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM0MTI1OTk5_size_16_color_FFFFFF_t_70 6]: /images/20221022/76b5b03309e64f85b60fed3c8a0cef3a.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM0MTI1OTk5_size_16_color_FFFFFF_t_70 7]: /images/20221022/eec9a7bd1dec4a889108d1af561fdff7.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM0MTI1OTk5_size_16_color_FFFFFF_t_70 8]: /images/20221022/8920f7ac99764254ace50afaaf978b5c.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM0MTI1OTk5_size_16_color_FFFFFF_t_70 9]: /images/20221022/3400dbc13b294199937961b5903c52f7.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM0MTI1OTk5_size_16_color_FFFFFF_t_70 10]: /images/20221022/7125ae9d8eba4e2e81715010d0a9e3f8.png