Spring Security的登录过程

SpringSecurity的登录过程：

1. UsernamePasswordAuthenticationFilter： 获得用户提交的用户名和密码信息 

2. UserDetailsService： 由其封装用户对象 

3. AbstractUserDetailsAuthenticationProvider： 转由其进行密码和权限验证，验证通过后封装一个Authentication 

4. ProviderManager： 会将Authentication封装到SecurityContext中（默认情况下，ProviderManager会在认证成功后清除掉Authentication的密码信息，但会保留用户名称） 

5. AbstractRememberMeServices ：判断请求参数中是否包含_spring_security_remember_me参数，如果包含并且值为（true，on,yes，1）中的任意一个，则将用户名和密码信息保存进cookie，否则不做处理 

6. AccessDecisionManager ：由其决定是否放行 

7. 之后在请求被保护的资源时，RememberMeAuthenticationFilter会先判断是否Authentication已经失效，如果失效，则试图从cookie中寻找，找到则重新封装Authentication。

login.jsp

    
   
   

        
    
    

            
     
     User Name:  
     
     
        
    
    
        
    
    

            
     
     Password:  
     
     
        
    
    

        
    
    

            
     
      
     
     Keep Me
                Signed In
        
    
    

        
    
    

            
     
     
        
    
    
    
   
   

security-context.xml

AuthorizationService.java 

@Service("AuthorizationService")
@Transactional(readOnly = true)
public class AuthorizationService implements UserDetailsService {

    @Autowired
    private AuthcationService authcationService;

    /*
     * (non-Javadoc)
     * @see
     * org.springframework.security.core.userdetails.UserDetailsService#loadUserByUsername(java.
     * lang.String)
     */
    @Override
    public UserDetails loadUserByUsername(String userName) throws UsernameNotFoundException {
        org.snippets.demo.security.User dbUser = authcationService.getUserByUserName(userName);
        boolean enabled = true;
        boolean accountNonExpired = true;
        boolean credentialsNonExpired = true;
        boolean accountNonLocked = true;
        List
   
   
    
     authorities = new ArrayList
    
    
     
     ();
        if (null == dbUser) {
            throw new UsernameNotFoundException("User does not exits");
        } else {
            if (dbUser.getLocked()) {
                accountNonLocked = false;
            }
        }

        return new User(userName, dbUser.getPasswd(), enabled, accountNonExpired, credentialsNonExpired,
                accountNonLocked, authorities);

    }
}