SpringSecurityOauth2 - Token校验逻辑,以及认证对象如何存到Security上下文中的(RemoteTokenServices)

关键词:
DefaultTokenServices, RemoteTokenServices, Authentication , SecurityContextHolder

入口一定是过滤器 而 SpringSecurityOauth2 资源服务器处理 Token校验的过滤器是 OAuth2AuthenticationProcessingFilter 我们直接从这个地方打断点进行分析:

FilterChainProxy

public class FilterChainProxy extends GenericFilterBean {
   

  private static final class VirtualFilterChain implements FilterChain {
   
  
   		private final FilterChain originalChain;
        private final List<Filter> additionalFilters;
        private final FirewalledRequest firewalledRequest;
        private final int size;
        private int currentPosition;

        private VirtualFilterChain(FirewalledRequest firewalledRequest, FilterChain chain, List<Filter> additionalFilters) {
   
            this.currentPosition = 0;
            this.originalChain = chain;
            this.additionalFilters = additionalFilters;
            this.size = additionalFilters.size();
            this.firewalledRequest = firewalledRequest;
        }

        public void doFilter(ServletRequest request, ServletResponse response) throws IOException, ServletException {
   
            if (this.currentPosition == this.size) {
   
                if (FilterChainProxy.logger.isDebugEnabled()) {
   
                    FilterChainProxy.logger.debug(LogMessage.of(() -> {
   
                        return "Secured " + FilterChainProxy.requestLine(this.firewalledRequest);
                    }));
                }

                this.firewalledRequest.reset();
                this.originalChain.doFilter(request, response);
            } else {
   
                ++this.currentPosition;
                Filter nextFilter = (Filter)this.additionalFilters.get(this.currentPosition - 1);
                if (FilterChainProxy.logger.isTraceEnabled()) {
   
                    FilterChainProxy.logger.trace(LogMessage.format("Invoking %s (%d/%d)", nextFilter.getClass().getSimpleName(), this.currentPosition, this.size));
                }
				
				// OAuth2AuthenticationProcessingFilter 用来校验Token的
                nextFilter.doFilter(request, response, this);
            }
        }
  }

}

OAuth2AuthenticationProcessingFilter

public class OAuth2AuthenticationProcessingFilter implements Filter, InitializingBean {
   
	public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain) throws IOException,
				ServletException {
   
	
			final boolean debug = logger.isDebugEnabled();
			final HttpServletRequest request = (HttpServletRequest) req;
			final HttpServletResponse response = (HttpServletResponse) res;
	
			try {
   
	
				Authentication authentication = tokenExtractor.extract(request);
				
				if (authentication == null) {
   
					if (stateless && isAuthenticated()) {
   
						if (debug) {
   
							logger.debug("Clearing security context.");
						}
						SecurityContextHolder.clearContext();
					}
					if (debug) {
   
						logger.debug(