登录验证机制的spring实现

//数据库操作，根据登录信息查找用户，返回Principal对象。
interface AuthenticationProvider {
	public Principal authenticate(Verifier verifier) throws AuthenticationException;
	public Principal get(Serializable id);
};
class TaobaoLoginAuthenticationProvider {
	....
}

interface Principal {
	public Serializable getIdentity();
	public String getName();
	public Long getLastLoginSeconds();
	public boolean isAvailable();
};
class User implements Principal {
}

//登录授权完整操作
interface IdentityValidator {
	....
};
//主要操作是读写Cookie
abstract class CookieIdentityValidator {
	boolean login(Verifier verifier);
	abstract Cookie createVisitorCookie(String registerName);
	abstract Cookie createPrincipalCookie(Principal principal);
}
class CookieIdentityValidatorImpl {
	Principal currentPrincipal();
	void logout();
	....
}

//登录信息包装器
interface verifier;  
class PasswordVerifier {
	String name;
	String password;
}

web.xml(applicationContext.xml)中配置过滤器
<bean id="cookieIdentityValidator" class="com.winxuan.framework.validator.impl.CookieIdentityValidator" abstract="true"/>
<bean id="identityValidator" class="com.winxuan.framework.validator.impl.CookieIdentityValidatorImpl" parent="cookieIdentityValidator">
<property name="authenticationProvider" ref="loginAuthenticationProvider"/>
<property name="visitorTarget" value="www-franchisee-cv"/>
<property name="principalTarget" value="www-franchisee-cp"/>
<property name="domain" value=".franchisee.winxuan.com"/>
</bean>

<filter>
<filter-name>loginFilter</filter-name>
<filter-class>com.winxuan.franchisee.support.web.filter.LoginFilter</filter-class>
</filter>

以上配置声明了验证的核心类CookieIdentityValidatorImpl.java，并注入相关属性值。可在LoginFilter.java中声明变量IdentityValidator，进行登录验证实现。

验证主流程如下：
首先在LoginFilter.java中验证用户是否登录，identityValidator.isLogined()；
用户登录，identityValidator.login(new PasswordVerifier(loginForm.getName(), loginForm.getPassword()))，该方法中包含AuthenticationProvider.authenticate(verify).