acegi security实践教程—basic认证之debug调试

debug调试：

 运行：http://localhost:8080/acegitest1/index.jsp

 因为web.xml中配置：

      <filter-name >AcegiFilterChainProxy </filter-name >
         <filter-class >
            org.acegisecurity.util.FilterToBeanProxy
         </filter-class >
       <init-param >
      <param-name >targetBean </param-name >
      <param-value >filterChainProxy </param-value >
      </init-param >

  

1. 进入：FilterToBeanProxy代理类中的doFilter，因为init只执行一次，启动时已经执行一次，所以访问url时，直接直接进入doFilter方法。

  

    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
        throws IOException, ServletException {
        if (!initialized ) {
            doInit();
        }
        delegate.doFilter(request, response, chain);
    }

2. 进入：目标类filterChainProxy 中的doFilter

    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
        throws IOException, ServletException {
        FilterInvocation fi = new FilterInvocation(request, response, chain);

        ConfigAttributeDefinition cad = this.filterInvocationDefinitionSource .getAttributes(fi);

        if (cad == null) {
            if ( logger.isDebugEnabled()) {
                logger.debug(fi.getRequestUrl() + " has no matching filters");
            }
            chain.doFilter(request, response);
            return;
        }
        Filter[] filters = obtainAllDefinedFilters(cad);
        if (filters.length == 0) {
            if ( logger.isDebugEnabled()) {
                logger.debug(fi.getRequestUrl() + " has an empty filter list");
            }

            chain.doFilter(request, response);
            return;
        }
        VirtualFilterChain virtualFilterChain = new VirtualFilterChain(fi, filters);
        virtualFilterChain.doFilter(fi.getRequest(), fi.getResponse());
    }

   这个方法，主要获取aceg配置文件中，用户配置了多少个filter，并且filter顺序以数组形式展示，这样就开始filter过滤连了。

3.进入：过滤连第一个filter，也就是咱们配置的basicProcessingFilter，其中doFilter如下：

 

      public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
            throws IOException, ServletException {

        if (!(request instanceof HttpServletRequest)) {
            throw new ServletException( "Can only process HttpServletRequest");
        }

        if (!(response instanceof HttpServletResponse)) {
            throw new ServletException( "Can only process HttpServletResponse");
        }

        HttpServletRequest httpRequest = (HttpServletRequest) request;
        HttpServletResponse httpResponse = (HttpServletResponse) response;

        String header = httpRequest.getHeader( "Authorization");

        if (logger.isDebugEnabled()) {
            logger.debug( "Authorization header: " + header);
        }

        if ((header != null) && header.startsWith( "Basic ")) {
            String base64Token = header.substring(6);
            String token = new String(Base64.decodeBase64(base64Token.getBytes()));

            String username = "";
            String password = "";
            int delim = token.indexOf( ":");

            if (delim != -1) {
                username = token.substring(0, delim);
                password = token.substring(delim + 1);
            }

            if (authenticationIsRequired(username)) {
                UsernamePasswordAuthenticationToken authRequest =
                        new UsernamePasswordAuthenticationToken(username, password);
                authRequest.setDetails(authenticationDetailsSource .buildDetails((HttpServletRequest) request));

                Authentication authResult;

                try {
                    authResult = authenticationManager.authenticate(authRequest);
                } catch (AuthenticationException failed) {
                    // Authentication failed
                    if ( logger.isDebugEnabled()) {
                        logger.debug( "Authentication request for user: " + username + " failed: " + failed.toString());
                    }

                    SecurityContextHolder.getContext().setAuthentication( null);

                    if ( rememberMeServices != null) {
                        rememberMeServices.loginFail(httpRequest, httpResponse);
                    }

                    if ( ignoreFailure) {
                        chain.doFilter(request, response);
                    } else {
                        authenticationEntryPoint.commence(request, response, failed);
                    }

                    return;
                }

                // Authentication success
                if ( logger.isDebugEnabled()) {
                    logger.debug( "Authentication success: " + authResult.toString());
                }

                SecurityContextHolder.getContext().setAuthentication(authResult);

                if ( rememberMeServices != null) {
                    rememberMeServices.loginSuccess(httpRequest, httpResponse, authResult);
                }
            }
        }

        chain.doFilter(request, response);
    }

   这个关键在于 if  ((header !=  null ) && header.startsWith(   "Basic " )),其中basic认证是把用户输入用户名和密码存放到header中，basic认证的。因为这个header为null【稍后在分析header】，所以执行下一个filter。

4.进入exceptionfilter

5.进入 filterInvocationInterceptor

     public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
        throws IOException, ServletException {
        FilterInvocation fi = new FilterInvocation(request, response, chain);
        invoke(fi);
    }

    跟着进去invoke，然后进入 InterceptorStatusToken token =  super .beforeInvocation(fi);最后关键处在于 ConfigAttributeDefinition attr =  this .obtainObjectDefinitionSource ().getAttributes(object);

    obtainObjectDefinitionSource  大家眼熟吧，就是acegi配置文件，配置那个文件有那个角色。因为index.jsp没有配置，所以获取为null

6.类似回调函数，一步步返回。这个页面就执行了一遍，即使exceptionfilter捕捉了异常，但是因为 index.jsp没有配置授权的事情，所以异常filter中的异常策略 authenticationEntryPoint 没执行。

  index.jsp访问完毕，我们来调试访问受保护的页面security.jsp，因为acegi进行配置了。上述已经把基本的流程跟大家调通，接下来就是不同之处，当然也是这个过滤连流程。因为访问受保护的资源，所以捕捉没有输入用户名和密码，然后异常交给basic处理，basic认证是弹出框，输入用户名和密码的。

  那我们输入正确有效的用户，测试如下：

  header如下：

  

 

你配置保护urlObjectDefinitionSource获取权限：

    public ConfigAttributeDefinition lookupAttributes(String url) {
        // Strip anything after a question mark symbol, as per SEC-161. See also SEC-321
        int firstQuestionMarkIndex = url.indexOf( "?");

        if (firstQuestionMarkIndex != -1) {
            url = url.substring(0, firstQuestionMarkIndex);
        }

        if (isConvertUrlToLowercaseBeforeComparison()) {
            url = url.toLowerCase();

            if ( logger.isDebugEnabled()) {
                logger.debug( "Converted URL to lowercase, from: '" + url + "'; to: '" + url + "'");
            }
        }

        Iterator iter = requestMap.iterator();

        while (iter.hasNext()) {
            EntryHolder entryHolder = (EntryHolder) iter.next();

            boolean matched = pathMatcher.match(entryHolder.getAntPath(), url);

            if ( logger.isDebugEnabled()) {
                logger.debug( "Candidate is: '" + url + "'; pattern is " + entryHolder.getAntPath() + "; matched="
                    + matched);
            }

            if (matched) {
                return entryHolder.getConfigAttributeDefinition();
            }
        }

        return null;
    }

   进行投票机制：

  关键代码：

     authenticated = SecurityContextHolder.getContext().getAuthentication();
     this. accessDecisionManager .decide(authenticated, object, attr);
     public int vote(Authentication authentication, Object object, ConfigAttributeDefinition config) {
        int result = ACCESS_ABSTAIN;
        Iterator iter = config.getConfigAttributes();

        while (iter.hasNext()) {
            ConfigAttribute attribute = (ConfigAttribute) iter.next();

            if ( this.supports(attribute)) {
                result = ACCESS_DENIED;

                // Attempt to find a matching granted authority
                for ( int i = 0; i < authentication.getAuthorities().length ; i++) {
                    if (attribute.getAttribute().equals(authentication.getAuthorities()[i].getAuthority())) {
                        return ACCESS_GRANTED;
                    }
                }
            }
        }

        return result;
    }
       while (iter.hasNext()) {
            AccessDecisionVoter voter = (AccessDecisionVoter) iter.next();
            int result = voter.vote(authentication, object, config);

            switch (result) {
            case AccessDecisionVoter. ACCESS_GRANTED:
                return;

            case AccessDecisionVoter. ACCESS_DENIED:
                deny++;

                break;

            default:
                break;
            }
        }

        if (deny > 0) {
            throw new AccessDeniedException(messages.getMessage("AbstractAccessDecisionManager.accessDenied" ,
                    "Access is denied"));
        }

      上述给的不是特别完整的代码，但是都是很关键的代码。大家可以下载源码，然后自己debug调试，同时我也会把acegi源码附上。

      一般情况下完整的系统很少使用basic认证，因为每个系统都有自己的登陆页，若未登陆应该跳转到登陆页面，若权限不足，应该跳转到accessdefined页面。那我们下篇博客搭建基于表单认证。

       项目源码：