Spring Security - UsernamePasswordAuthenticationFilter 分析

UsernamePasswordAuthenticationFilter过滤器对应的类路径为 
org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter 
实际上这个Filter类的doFilter是父类 AbstractAuthenticationProcessingFilter 的 

public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain)  
        throws IOException, ServletException {  
  
    HttpServletRequest request = (HttpServletRequest) req;  
    HttpServletResponse response = (HttpServletResponse) res;  
    //判断form-login标签是否包含login-processing-url属性  
      //如果没有采用默认的url：j_spring_security_check  
    //如果拦截的url不需要认证，直接跳过  
    if (!requiresAuthentication(request, response)) {  
        chain.doFilter(request, response);  
  
        return;  
    }  
  
    if (logger.isDebugEnabled()) {  
        logger.debug("Request is to process authentication");  
    }  
  
    Authentication authResult;  
  
    try {  
        //由子类完成认证  
        authResult = attemptAuthentication(request, response);  
        if (authResult == null) {  
            // return immediately as subclass has indicated that it hasn't completed authentication  
            return;  
        }  
        //session策略处理认证信息  
          //sessionStrategy是通过session-management标签中定义的  
          //session管理策略构造的SessionAuthenticationStrategy  
        //具体的session管理比较复杂，部分后面单个篇幅讲解  
        sessionStrategy.onAuthentication(authResult, request, response);  
    }  
    catch (AuthenticationException failed) {  
        // Authentication failed  
        //认证失败处理  
        unsuccessfulAuthentication(request, response, failed);  
  
        return;  
    }  
  
    // Authentication success  
    if (continueChainBeforeSuccessfulAuthentication) {  
        chain.doFilter(request, response);  
    }  
    //认证成功处理  
     //1.向SecurityContext中设置Authentication认证信息  
     //2.如果有remember me服务，则查找请求参数中是否包含_spring_security_remember_me，如果该参数值为true、yes、on、1则执行remember me功能:添加cookie、入库。为下次请求时自动登录做准备  
     //3.发布认证成功事件  
     //4.执行跳转  
    successfulAuthentication(request, response, authResult);  
}  

子类 UsernamePasswordAuthenticationFilter 的认证方法 attemptAuthentication 

public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response) throws AuthenticationException {  
    //只处理post提交的请求  
    if (postOnly && !request.getMethod().equals("POST")) {  
        throw new AuthenticationServiceException("Authentication method not supported: " + request.getMethod());  
    }  
    //获取用户名、密码数据  
    String username = obtainUsername(request);  
    String password = obtainPassword(request);  
  
    if (username == null) {  
        username = "";  
    }  
  
    if (password == null) {  
        password = "";  
    }  
  
    username = username.trim();  
    //构造未认证的UsernamePasswordAuthenticationToken  
    UsernamePasswordAuthenticationToken authRequest = new UsernamePasswordAuthenticationToken(username, password);  
  
    // Place the last username attempted into HttpSession for views  
    HttpSession session = request.getSession(false);  
    //如果session不为空，添加username到session中  
    if (session != null || getAllowSessionCreation()) {  
        request.getSession().setAttribute(SPRING_SECURITY_LAST_USERNAME_KEY, TextEscapeUtils.escapeEntities(username));  
    }  
  
    // Allow subclasses to set the "details" property  
    //设置details，这里就是设置org.springframework.security.web.  
    //authentication.WebAuthenticationDetails实例到details中  
    setDetails(request, authRequest);  
    //通过AuthenticationManager:ProviderManager完成认证任务  
    return this.getAuthenticationManager().authenticate(authRequest);  
}  

这里的authenticationManager变量也是通过解析form-login标签，构造bean时注入的，具体解析类为：org.springframework.security.config.http.AuthenticationConfigBuilder 
代码片段为： 

void createFormLoginFilter(BeanReference sessionStrategy, BeanReference authManager) {  
  
    Element formLoginElt = DomUtils.getChildElementByTagName(httpElt, Elements.FORM_LOGIN);  
  
    if (formLoginElt != null || autoConfig) {  
        FormLoginBeanDefinitionParser parser = new FormLoginBeanDefinitionParser("/j_spring_security_check",  
                AUTHENTICATION_PROCESSING_FILTER_CLASS, requestCache, sessionStrategy);  
  
        parser.parse(formLoginElt, pc);  
        formFilter = parser.getFilterBean();  
        formEntryPoint = parser.getEntryPointBean();  
    }  
  
    if (formFilter != null) {  
        formFilter.getPropertyValues().addPropertyValue("allowSessionCreation", new Boolean(allowSessionCreation));  
        //设置authenticationManager的bean依赖  
        formFilter.getPropertyValues().addPropertyValue("authenticationManager", authManager);  
  
  
        // Id is required by login page filter  
        formFilterId = pc.getReaderContext().generateBeanName(formFilter);  
        pc.registerBeanComponent(new BeanComponentDefinition(formFilter, formFilterId));  
        injectRememberMeServicesRef(formFilter, rememberMeServicesId);  
    }  

继续看ProviderManager代码。实际上authenticate方法由ProviderManager的父类定义，并且authenticate方法内调用子类的doAuthentication方法，记得这是设计模式中的模板模式 

public Authentication doAuthentication(Authentication authentication) throws AuthenticationException {  
    Class<? extends Authentication> toTest = authentication.getClass();  
    AuthenticationException lastException = null;  
    Authentication result = null;  
    //循环ProviderManager中的providers，由具体的provider执行认证操作  
    for (AuthenticationProvider provider : getProviders()) {  
        System.out.println("AuthenticationProvider: " + provider.getClass().getName());  
        if (!provider.supports(toTest)) {  
            continue;  
        }  
  
        logger.debug("Authentication attempt using " + provider.getClass().getName());  
  
        try {  
            result = provider.authenticate(authentication);  
  
            if (result != null) {  
                //复制details  
                copyDetails(authentication, result);  
                break;  
            }  
        } catch (AccountStatusException e) {  
            // SEC-546: Avoid polling additional providers if auth failure is due to invalid account status  
            eventPublisher.publishAuthenticationFailure(e, authentication);  
            throw e;  
        } catch (AuthenticationException e) {  
            lastException = e;  
        }  
    }  
  
    if (result == null && parent != null) {  
        // Allow the parent to try.  
        try {  
            result = parent.authenticate(authentication);  
        } catch (ProviderNotFoundException e) {  
            // ignore as we will throw below if no other exception occurred prior to calling parent and the parent  
            // may throw ProviderNotFound even though a provider in the child already handled the request  
        } catch (AuthenticationException e) {  
            lastException = e;  
        }  
    }  
  
    if (result != null) {  
        eventPublisher.publishAuthenticationSuccess(result);  
        return result;  
    }  
  
    // Parent was null, or didn't authenticate (or throw an exception).  
  
    if (lastException == null) {  
        lastException = new ProviderNotFoundException(messages.getMessage("ProviderManager.providerNotFound",  
                    new Object[] {toTest.getName()}, "No AuthenticationProvider found for {0}"));  
    }  
    //由注入进来的org.springframework.security.authentication.DefaultAuthenticationEventPublisher完成事件发布任务  
    eventPublisher.publishAuthenticationFailure(lastException, authentication);  
  
    throw lastException;  
}  

ProviderManager类中的providers由哪些provider呢？如果看完authentication-manager标签解析的讲解，应该知道注入到providers中的provider分别为： 
org.springframework.security.authentication.dao.DaoAuthenticationProvider 
org.springframework.security.authentication.AnonymousAuthenticationProvider 
其他的provider根据特殊情况，再添加到providers中的，如remember me功能的provider org.springframework.security.authentication.RememberMeAuthenticationProvider 

可以看出来，ProviderManager仅仅是管理provider的，具体的authenticate认证任务由各自provider来完成。 

现在来看DaoAuthenticationProvider的认证处理，实际上authenticate由父类AbstractUserDetailsAuthenticationProvider完成。代码如下 

public Authentication authenticate(Authentication authentication) throws AuthenticationException {  
    …………  
     //获取登录的用户名  
    String username = (authentication.getPrincipal() == null) ? "NONE_PROVIDED" : authentication.getName();  
  
    boolean cacheWasUsed = true;  
    //如果配置了缓存，从缓存中获取UserDetails实例  
    UserDetails user = this.userCache.getUserFromCache(username);  
  
    if (user == null) {  
        cacheWasUsed = false;  
  
        try {  
            //如果UserDetails为空，则由具体子类DaoAuthenticationProvider  
            //根据用户名、authentication获取UserDetails  
            user = retrieveUser(username, (UsernamePasswordAuthenticationToken) authentication);  
        } catch (UsernameNotFoundException notFound) {  
            if (hideUserNotFoundExceptions) {  
                throw new BadCredentialsException(messages.getMessage(  
                        "AbstractUserDetailsAuthenticationProvider.badCredentials", "Bad credentials"));  
            } else {  
                throw notFound;  
            }  
        }  
  
        Assert.notNull(user, "retrieveUser returned null - a violation of the interface contract");  
    }  
  
    try {  
        //一些认证检查（账号是否可用、是否过期、是否被锁定）  
        preAuthenticationChecks.check(user);  
        //额外的密码检查（salt、passwordEncoder）  
        additionalAuthenticationChecks(user, (UsernamePasswordAuthenticationToken) authentication);  
    } catch (AuthenticationException exception) {  
        if (cacheWasUsed) {  
            // There was a problem, so try again after checking  
            // we're using latest data (i.e. not from the cache)  
            cacheWasUsed = false;  
            user = retrieveUser(username, (UsernamePasswordAuthenticationToken) authentication);  
            preAuthenticationChecks.check(user);  
            additionalAuthenticationChecks(user, (UsernamePasswordAuthenticationToken) authentication);  
        } else {  
            throw exception;  
        }  
    }  
    //检查账号是否过期  
    postAuthenticationChecks.check(user);  
    //添加UserDetails到缓存中  
    if (!cacheWasUsed) {  
        this.userCache.putUserInCache(user);  
    }  
  
    Object principalToReturn = user;  
  
    if (forcePrincipalAsString) {  
        principalToReturn = user.getUsername();  
    }  
    //返回成功认证后的Authentication  
    return createSuccessAuthentication(principalToReturn, authentication, user);  
}  

继续看DaoAuthenticationProvider的retrieveUser方法 

protected final UserDetails retrieveUser(String username, UsernamePasswordAuthenticationToken authentication)  
        throws AuthenticationException {  
    UserDetails loadedUser;  
  
    try {  
        //最关键的部分登场了  
          //UserDetailService就是authentication-provider标签中定义的  
          //属性user-service-ref  
        loadedUser = this.getUserDetailsService().loadUserByUsername(username);  
    }  
    catch (DataAccessException repositoryProblem) {  
        throw new AuthenticationServiceException(repositoryProblem.getMessage(), repositoryProblem);  
    }  
  
    if (loadedUser == null) {  
        throw new AuthenticationServiceException(  
                "UserDetailsService returned null, which is an interface contract violation");  
    }  
    return loadedUser;  
}  

实际上，只要实现UserDetailsService接口的loadUserByUsername方法，就完成了登录认证的工作 

<authentication-manager alias="authenticationManager">  
    <authentication-provider user-service-ref="userDetailsManager"/>  
</authentication-manager> 

很多教程上说配置JdbcUserDetailsManager这个UserDetailsService，实际上该类的父类 
JdbcDaoImpl方法loadUserByUsername代码如下： 

  public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException, DataAccessException {  
        //根据username从数据库中查询User数据  
        List<UserDetails> users = loadUsersByUsername(username);  
  
        if (users.size() == 0) {  
            throw new UsernameNotFoundException(  
                    messages.getMessage("JdbcDaoImpl.notFound", new Object[]{username}, "Username {0} not found"), username);  
        }  
  
        UserDetails user = users.get(0); // contains no GrantedAuthority[]  
  
        Set<GrantedAuthority> dbAuthsSet = new HashSet<GrantedAuthority>();  
        //添加授权信息  
        if (enableAuthorities) {  
            dbAuthsSet.addAll(loadUserAuthorities(user.getUsername()));  
        }  
        //是否使用了Group  
        if (enableGroups) {  
            dbAuthsSet.addAll(loadGroupAuthorities(user.getUsername()));  
        }  
  
        List<GrantedAuthority> dbAuths = new ArrayList<GrantedAuthority>(dbAuthsSet);  
  
        addCustomAuthorities(user.getUsername(), dbAuths);  
  
        if (dbAuths.size() == 0) {  
            throw new UsernameNotFoundException(  
                    messages.getMessage("JdbcDaoImpl.noAuthority",  
                            new Object[] {username}, "User {0} has no GrantedAuthority"), username);  
        }  
  
        return createUserDetails(username, user, dbAuths);  
    }  
  
    //usersByUsernameQuery查询语句可配置  
     //直接从数据库中查询该username对应的数据，并构造User对象  
    protected List<UserDetails> loadUsersByUsername(String username) {  
        return getJdbcTemplate().query(usersByUsernameQuery, new String[] {username}, new RowMapper<UserDetails>() {  
            public UserDetails mapRow(ResultSet rs, int rowNum) throws SQLException {  
                String username = rs.getString(1);  
                String password = rs.getString(2);  
                boolean enabled = rs.getBoolean(3);  
                return new User(username, password, enabled, true, true, true, AuthorityUtils.NO_AUTHORITIES);  
            }  
  
        });  
    }  
  
……  
    protected UserDetails createUserDetails(String username, UserDetails userFromUserQuery,  
            List<GrantedAuthority> combinedAuthorities) {  
        String returnUsername = userFromUserQuery.getUsername();  
  
        if (!usernameBasedPrimaryKey) {  
            returnUsername = username;  
        }  
        //根据用户名、密码、enabled、授权列表构造UserDetails实例User  
        return new User(returnUsername, userFromUserQuery.getPassword(), userFromUserQuery.isEnabled(),  
                true, true, true, combinedAuthorities);  
    }  

其他的provider，如 
RememberMeAuthenticationProvider、AnonymousAuthenticationProvider的认证处理都很简单，首先判断是否支持Authentication，不支持直接返回null，支持也不处理直接返回该Authentication 

这里需要强调一下，DaoAuthenticationProvider只支持UsernamePasswordAuthenticationToken这个Authentication。如果对其他的Authentication，DaoAuthenticationProvider是不做处理的