SpringSecurity的登录过程:
1. UsernamePasswordAuthenticationFilter: 获得用户提交的用户名和密码信息
2. UserDetailsService: 由其封装用户对象
3. AbstractUserDetailsAuthenticationProvider: 转由其进行密码和权限验证,验证通过后封装一个Authentication
4. ProviderManager: 会将Authentication封装到SecurityContext中(默认情况下,ProviderManager会在认证成功后清除掉Authentication的密码信息,但会保留用户名称)
5. AbstractRememberMeServices :判断请求参数中是否包含_spring_security_remember_me参数,如果包含并且值为(true,on,yes,1)中的任意一个,则将用户名和密码信息保存进cookie,否则不做处理
6. AccessDecisionManager :由其决定是否放行
7. 之后在请求被保护的资源时,RememberMeAuthenticationFilter会先判断是否Authentication已经失效,如果失效,则试图从cookie中寻找,找到则重新封装Authentication。
login.jsp
security-context.xml
AuthorizationService.java
@Service("AuthorizationService")
@Transactional(readOnly = true)
public class AuthorizationService implements UserDetailsService {
@Autowired
private AuthcationService authcationService;
/*
* (non-Javadoc)
* @see
* org.springframework.security.core.userdetails.UserDetailsService#loadUserByUsername(java.
* lang.String)
*/
@Override
public UserDetails loadUserByUsername(String userName) throws UsernameNotFoundException {
org.snippets.demo.security.User dbUser = authcationService.getUserByUserName(userName);
boolean enabled = true;
boolean accountNonExpired = true;
boolean credentialsNonExpired = true;
boolean accountNonLocked = true;
List
authorities = new ArrayList
();
if (null == dbUser) {
throw new UsernameNotFoundException("User does not exits");
} else {
if (dbUser.getLocked()) {
accountNonLocked = false;
}
}
return new User(userName, dbUser.getPasswd(), enabled, accountNonExpired, credentialsNonExpired,
accountNonLocked, authorities);
}
}