概要
接口跳转源码分析
springsecurity6中http://localhost:8080/test/toLogin?username=lkz&pwd=123456的源码跟踪
相关代码
controller层
package com.lkz.controller;
import com.lkz.service.UserService;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.web.bind.annotation.PathVariable;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RequestParam;
import org.springframework.web.bind.annotation.RestController;
@RestController
@RequestMapping("/test")
public class SpringSecurityController {
@Autowired
UserService userService;
@RequestMapping({"/index","/"})
public String index(int id){
System.out.println(userService.selectPermsById(id));
System.out.println(userService.selectNameById(id));
return "index";
}
@RequestMapping("/toLogin")
public String toLogin(@RequestParam("username") String username, @RequestParam("pwd") String pwd){
String login = userService.login(username, pwd);
return "OK";
}
@RequestMapping("/level1/{a}")
public String toLevel1(@PathVariable("a") String a){
return "views/level1/"+a;
}
@RequestMapping("/level2/{b}")
public String toLevel2(@PathVariable("b") String b){
return "views/level2/"+b;
}
@RequestMapping("/level3/{c}")
public String toLevel3(@PathVariable("c") String c){
return "views/level3/"+c;
}
}
service层
package com.lkz.service;
import com.lkz.mapper.UserMapper;
import com.lkz.pojo.User;
import org.apache.ibatis.annotations.Param;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.stereotype.Service;
public interface UserService {
public String selectPermsById(int id);
String selectNameById(@Param("id") int id);
String selectPwdById(@Param("id") int id);
User selectUser(@Param("username")String name);
//登陆逻辑
String login(String username,String pwd);
}
serviceimpl
package com.lkz.service.impl;
import com.lkz.mapper.UserMapper;
import com.lkz.pojo.User;
import com.lkz.service.UserService;
import lombok.extern.slf4j.Slf4j;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.springframework.security.core.Authentication;
import org.springframework.stereotype.Service;
@Service
@Slf4j
public class UserServiceImpl implements UserService {
@Autowired
UserMapper userMapper;
private final AuthenticationManager authenticationManager;
public UserServiceImpl(AuthenticationManager authenticationManager) {
this.authenticationManager = authenticationManager;
}
@Override
public String selectPermsById(int id) {
String perms = userMapper.selectPermsById(id);
return perms;
}
@Override
public String selectNameById(int id) {
String username = userMapper.selectNameById(id);
return username;
}
public String selectPwdById(int id) {
String pwd = userMapper.selectPwdById(id);
return pwd;
}
public User selectUser(String name) {
User user= userMapper.selectUser(name);
return user;
}
public String login(String username,String pwd){
//传入用户名和密码
UsernamePasswordAuthenticationToken authentication = new UsernamePasswordAuthenticationToken(username, pwd);
//实现登陆逻辑，此时就会去调用loadUserByUsername
//authenticate其实就是UserDetails（authentication前台拿到的user对象）
Authentication authenticate = authenticationManager.authenticate(authentication);
log.info("authenticate========="+authenticate);
return "OKKKKK";
}
}
userDetailserviceimpl获得数据库对象的方法实现类
package com.lkz.service.impl;
import com.lkz.mapper.UserMapper;
import com.lkz.pojo.User;
import lombok.extern.slf4j.Slf4j;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.authority.AuthorityUtils;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.core.userdetails.UsernameNotFoundException;
import org.springframework.stereotype.Service;
import java.util.List;
/**
* UserDetails:得出库里的数据
*/
@Service
@Slf4j
public class UserDetailServiceImpl implements UserDetailsService {
@Autowired
private UserMapper userMapper;
@Override
public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
User user = userMapper.selectUser(username);
if (user == null) {
throw new UsernameNotFoundException("User not found with username: " + username);
}
log.info("user======"+user.getPwd());
List<GrantedAuthority> atuhs = AuthorityUtils.commaSeparatedStringToAuthorityList(user.getPerms());
return new org.springframework.security.core.userdetails.User(
user.getUsername(),
user.getPwd(),
atuhs
/* Add user roles/authorities here */);
}
}
源码跳转
核心主要是从login处的源码追踪
所涉及到的主要方法：
- login：controller跳转进入的登陆逻辑方法
- authenticate：login方法中总的认证入口方法
- provider.authenticate(authentication)：拿着前台传入的用户名密码对象authentication进行认证
- retrieveUser(username, (UsernamePasswordAuthenticationToken) authentication)：检索user对象【打算调用数据库查的方法了，所以必须要传入用户名，以及前台对象authentication】
- this.getUserDetailsService().loadUserByUsername(username)：计划调用自写的实现类的方法调数据库查user对象
- additionalAuthenticationChecks(user, (UsernamePasswordAuthenticationToken) authentication)：将user对象【库里的】和前台接收到组合后的待比对user对象【authentication】
- this.passwordEncoder.matches(presentedPassword, userDetails.getPassword()))：进入比对方法
- BCrypt.checkpw(rawPassword.toString(), encodedPassword)：将前台明文和库里密文传入，获取盐进行加密比对【equalsNoEarlyReturn】
- equalsNoEarlyReturn(hashed, hashpwforcheck(passwordb, hashed))：将库里取出的密文和前台接受到的明文加密后比对
源码中的核心代码
authenticate：login方法中总的认证入口方法
@Override
public Authentication authenticate(Authentication authentication) throws AuthenticationException {
Class<? extends Authentication> toTest = authentication.getClass();
AuthenticationException lastException = null;
AuthenticationException parentException = null;
Authentication result = null;
Authentication parentResult = null;
int currentPosition = 0;
int size = this.providers.size();
for (AuthenticationProvider provider : getProviders()) {
if (!provider.supports(toTest)) {
continue;
}
if (logger.isTraceEnabled()) {
logger.trace(LogMessage.format("Authenticating request with %s (%d/%d)",
provider.getClass().getSimpleName(), ++currentPosition, size));
}
try {
result = provider.authenticate(authentication);
if (result != null) {
copyDetails(authentication, result);
break;
}
}
catch (AccountStatusException | InternalAuthenticationServiceException ex) {
prepareException(ex, authentication);
// SEC-546: Avoid polling additional providers if auth failure is due to
// invalid account status
throw ex;
}
catch (AuthenticationException ex) {
lastException = ex;
}
}
if (result == null && this.parent != null) {
// Allow the parent to try.
try {
parentResult = this.parent.authenticate(authentication);
result = parentResult;
}
catch (ProviderNotFoundException ex) {
// ignore as we will throw below if no other exception occurred prior to
// calling parent and the parent
// may throw ProviderNotFound even though a provider in the child already
// handled the request
}
catch (AuthenticationException ex) {
parentException = ex;
lastException = ex;
}
}
if (result != null) {
if (this.eraseCredentialsAfterAuthentication && (result instanceof CredentialsContainer)) {
// Authentication is complete. Remove credentials and other secret data
// from authentication
((CredentialsContainer) result).eraseCredentials();
}
// If the parent AuthenticationManager was attempted and successful then it
// will publish an AuthenticationSuccessEvent
// This check prevents a duplicate AuthenticationSuccessEvent if the parent
// AuthenticationManager already published it
if (parentResult == null) {
this.eventPublisher.publishAuthenticationSuccess(result);
}
return result;
}
// Parent was null, or didn't authenticate (or throw an exception).
if (lastException == null) {
lastException = new ProviderNotFoundException(this.messages.getMessage("ProviderManager.providerNotFound",
new Object[] { toTest.getName() }, "No AuthenticationProvider found for {0}"));
}
// If the parent AuthenticationManager was attempted and failed then it will
// publish an AbstractAuthenticationFailureEvent
// This check prevents a duplicate AbstractAuthenticationFailureEvent if the
// parent AuthenticationManager already published it
if (parentException == null) {
prepareException(lastException, authentication);
}
throw lastException;
}
provider.authenticate(authentication)：拿着前台传入的用户名密码对象authentication进行认证 AbstractUserDetailsAuthenticationProvider实现类的
@Override
public Authentication authenticate(Authentication authentication) throws AuthenticationException {
Assert.isInstanceOf(UsernamePasswordAuthenticationToken.class, authentication,
() -> this.messages.getMessage("AbstractUserDetailsAuthenticationProvider.onlySupports",
"Only UsernamePasswordAuthenticationToken is supported"));
String username = determineUsername(authentication);
boolean cacheWasUsed = true;
UserDetails user = this.userCache.getUserFromCache(username);
if (user == null) {
cacheWasUsed = false;
try {
user = retrieveUser(username, (UsernamePasswordAuthenticationToken) authentication);
}
catch (UsernameNotFoundException ex) {
this.logger.debug("Failed to find user '" + username + "'");
if (!this.hideUserNotFoundExceptions) {
throw ex;
}
throw new BadCredentialsException(this.messages
.getMessage("AbstractUserDetailsAuthenticationProvider.badCredentials", "Bad credentials"));
}
Assert.notNull(user, "retrieveUser returned null - a violation of the interface contract");
}
try {
this.preAuthenticationChecks.check(user);
additionalAuthenticationChecks(user, (UsernamePasswordAuthenticationToken) authentication);
}
retrieveUser(username, (UsernamePasswordAuthenticationToken) authentication)：检索user对象【打算调用数据库查的方法了，所以必须要传入用户名，以及前台对象authentication】
@Override
protected final UserDetails retrieveUser(String username, UsernamePasswordAuthenticationToken authentication)
throws AuthenticationException {
prepareTimingAttackProtection();
try {
UserDetails loadedUser = this.getUserDetailsService().loadUserByUsername(username);
if (loadedUser == null) {
throw new InternalAuthenticationServiceException(
"UserDetailsService returned null, which is an interface contract violation");
}
return loadedUser;
}
catch (UsernameNotFoundException ex) {
mitigateAgainstTimingAttack(authentication);
throw ex;
}
catch (InternalAuthenticationServiceException ex) {
throw ex;
}
catch (Exception ex) {
throw new InternalAuthenticationServiceException(ex.getMessage(), ex);
}
}
返回到AbstractUserDetailsAuthenticationProvider实现类中，继续执行additionalAuthenticationChecks
try {
this.preAuthenticationChecks.check(user);
additionalAuthenticationChecks(user, (UsernamePasswordAuthenticationToken) authentication);
}
AbstractUserDetailsAuthenticationProvider抽象类-->DaoAuthenticationProvider实现类中的additionalAuthenticationChecks
protected void additionalAuthenticationChecks(UserDetails userDetails,
UsernamePasswordAuthenticationToken authentication) throws AuthenticationException {
if (authentication.getCredentials() == null) {
this.logger.debug("Failed to authenticate since no credentials provided");
throw new BadCredentialsException(this.messages
.getMessage("AbstractUserDetailsAuthenticationProvider.badCredentials", "Bad credentials"));
}
String presentedPassword = authentication.getCredentials().toString();
if (!this.passwordEncoder.matches(presentedPassword, userDetails.getPassword())) {
this.logger.debug("Failed to authenticate since password does not match stored value");
throw new BadCredentialsException(this.messages
.getMessage("AbstractUserDetailsAuthenticationProvider.badCredentials", "Bad credentials"));
}
}
matches核心方法，调PasswordEncoder接口--->BCryptPasswordEncoder实现类的
@Override
public boolean matches(CharSequence rawPassword, String encodedPassword) {
if (rawPassword == null) {
throw new IllegalArgumentException("rawPassword cannot be null");
}
if (encodedPassword == null || encodedPassword.length() == 0) {
this.logger.warn("Empty encoded password");
return false;
}
if (!this.BCRYPT_PATTERN.matcher(encodedPassword).matches()) {
this.logger.warn("Encoded password does not look like BCrypt");
return false;
}
return BCrypt.checkpw(rawPassword.toString(), encodedPassword);
}
BCrypt.checkpw
public static boolean checkpw(String plaintext, String hashed) {
byte[] passwordb = plaintext.getBytes(StandardCharsets.UTF_8);
return equalsNoEarlyReturn(hashed, hashpwforcheck(passwordb, hashed));
}
equalsNoEarlyReturn
static boolean equalsNoEarlyReturn(String a, String b) {
return MessageDigest.isEqual(a.getBytes(StandardCharsets.UTF_8), b.getBytes(StandardCharsets.UTF_8));
}
最后会执行到login中总的认证方法中，result = provider.authenticate(authentication);不为空，返回的是result对象
认证成功
后台会有显示已认证
小结
核心就是比对密码，要注意数据库中放密文
2504
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
