1. Spring Security认证原理
2. Authentication
3. 如何验证用户身份
4. AuthenticationManager
5. DaoAuthenticationProvider
6. UserDetails
7. 认证流程图

Spring Security认证原理

核心组件

SecurityContextHolder

SecurityContextHolder.getContext().getAuthentication().getPrincipal()

Authentication

package org.springframework.security.core;

import java.io.Serializable;
import java.security.Principal;
import java.util.Collection;

public interface Authentication extends Principal, Serializable {
    //获取权限
    Collection<? extends GrantedAuthority> getAuthorities();
    //获取密码，一般在认证后会被移除
    Object getCredentials();
    //得到WebAuthenticationDetails的实现，记录了访问者的ip地址和sessionid，如果是JWT，其中的内容就无用了
    Object getDetails();
    //非常关键的一个方法，返回Principal，什么是Principal已经知道了，在Spring Security里就是Authenticate的实现类
    Object getPrincipal();
    //判断当前身份已经通过认证了吗？
    boolean isAuthenticated();
    //设置当前身份为已经通过认证
    void setAuthenticated(boolean var1) throws IllegalArgumentException;
}

This interface represents the abstract notion of a principal, which
can be used to represent any entity, such as an individual, a
corporation, and a login id.

@RestController
@RequestMapping("/objects")
public class BaseController {

    @GetMapping("/authentication")
    public Authentication getMessage() {

        return SecurityContextHolder.getContext().getAuthentication();
    }
}

{
    "authorities": [
        {
            "authority": "ROLE_ANONYMOUS"
        }
    ],
    "details": {
        "remoteAddress": "0:0:0:0:0:0:0:1",
        "sessionId": null
    },
    "authenticated": true,
    "principal": "anonymousUser",
    "keyHash": -2031280993,
    "credentials": "",
    "name": "anonymousUser"
}

    void setAuthenticated(boolean var1) throws IllegalArgumentException;

如何验证用户身份

1. 过滤器UsernamePasswordAuthenticationFilter拿到POST请求中的用户名和密码，然后把用户名和密码封到Authentication的实现类中，这个实现类一般是UsernamePasswordAuthenticationToken。
2. 把Authentication交给AuthenticationManager进行验证
3. AuthenticationManager会调用其中的各种AuthenticationProvider去进行验证，只要验证通过，就会新建一个带有Authority的Authentication对象，之后最关键的是会进行super.setAuthenticated(true);，表示认证通过。
4. 过滤器检查是否认证通过，如果通过，就调用安全上下文容器的.getContext().setAuthentication(…)方法，把Authentication设置到其中。（这个是在）AbstractAuthenticationProcessingFilter的successfulAuthentication方法中。
5. 所有过滤器都会检查安全上下文中的Authentication对象，如果检测到isAuthenticated()==true，就放行（当然还有权限的问题，这里先简化）。验证不通过，就会抛出各种异常然后返回。
6. 返回异常则没有通过验证。如果Authentication一路被放行到控制器，控制器就成功接受响应，这样就完成了一次成功的安全验证。

AuthenticationManager

public interface AuthenticationManager {
    Authentication authenticate(Authentication var1) throws AuthenticationException;
}

public class ProviderManager implements AuthenticationManager, MessageSourceAware, InitializingBean {
    private List<AuthenticationProvider> providers;

    public ProviderManager(List<AuthenticationProvider> providers, AuthenticationManager parent) {
        this.eventPublisher = new ProviderManager.NullEventPublisher();
        this.providers = Collections.emptyList();
        this.messages = SpringSecurityMessageSource.getAccessor();
        this.eraseCredentialsAfterAuthentication = true;
        Assert.notNull(providers, "providers list cannot be null");
        this.providers = providers;
        this.parent = parent;
        this.checkState();
    }

    @Override
    public Authentication authenticate(Authentication authentication) throws AuthenticationException {
        Class<? extends Authentication> toTest = authentication.getClass();
        AuthenticationException lastException = null;
        AuthenticationException parentException = null;
        Authentication result = null;
        Authentication parentResult = null;
        boolean debug = logger.isDebugEnabled();
        Iterator var8 = this.getProviders().iterator();

        while(var8.hasNext()) {
            AuthenticationProvider provider = (AuthenticationProvider)var8.next();
            if (provider.supports(toTest)) {
                if (debug) {
                    logger.debug("Authentication attempt using " + provider.getClass().getName());
                }

                try {
                    result = provider.authenticate(authentication);
                    if (result != null) {
                        this.copyDetails(authentication, result);
                        break;
                    }
                } catch (AccountStatusException var13) {
                    this.prepareException(var13, authentication);
                    throw var13;
                } catch (InternalAuthenticationServiceException var14) {
                    this.prepareException(var14, authentication);
                    throw var14;
                } catch (AuthenticationException var15) {
                    lastException = var15;
                }
            }
        }

        ......
    }
}

AbstractAuthenticationToken, AbstractOAuth2TokenAuthenticationToken, AnonymousAuthenticationToken,
BearerTokenAuthenticationToken, CasAssertionAuthenticationToken, CasAuthenticationToken,
JaasAuthenticationToken, JwtAuthenticationToken, OAuth2AuthenticationToken,
OAuth2AuthorizationCodeAuthenticationToken, OAuth2LoginAuthenticationToken,
OpenIDAuthenticationToken, PreAuthenticatedAuthenticationToken, RememberMeAuthenticationToken,
RunAsUserToken, TestingAuthenticationToken, UsernamePasswordAuthenticationToken

AuthenticationProvider

AbstractJaasAuthenticationProvider, AbstractLdapAuthenticationProvider, AbstractUserDetailsAuthenticationProvider,
ActiveDirectoryLdapAuthenticationProvider, AnonymousAuthenticationProvider,
AuthenticationManagerBeanDefinitionParser.NullAuthenticationProvider, CasAuthenticationProvider,
DaoAuthenticationProvider, DefaultJaasAuthenticationProvider, JaasAuthenticationProvider,
JwtAuthenticationProvider, LdapAuthenticationProvider, OAuth2AuthorizationCodeAuthenticationProvider,
OAuth2LoginAuthenticationProvider, OidcAuthorizationCodeAuthenticationProvider, OpenIDAuthenticationProvider,
PreAuthenticatedAuthenticationProvider, RememberMeAuthenticationProvider, RemoteAuthenticationProvider,
RunAsImplAuthenticationProvider, TestingAuthenticationProvider

public class DaoAuthenticationProvider extends AbstractUserDetailsAuthenticationProvider {
    private static final String USER_NOT_FOUND_PASSWORD = "userNotFoundPassword";
    //密码编码器
    private PasswordEncoder passwordEncoder;
    private volatile String userNotFoundEncodedPassword;
    //UserDetailsService对象，关键
    private UserDetailsService userDetailsService;
    private UserDetailsPasswordService userDetailsPasswordService;


    protected final UserDetails retrieveUser(String username, UsernamePasswordAuthenticationToken authentication) throws AuthenticationException {
        this.prepareTimingAttackProtection();

        try {
            UserDetails loadedUser = this.getUserDetailsService().loadUserByUsername(username);
            if (loadedUser == null) {
                throw new InternalAuthenticationServiceException("UserDetailsService returned null, which is an interface contract violation");
            } else {
                return loadedUser;
            }
        } catch (UsernameNotFoundException var4) {
            this.mitigateAgainstTimingAttack(authentication);
            throw var4;
        } catch (InternalAuthenticationServiceException var5) {
            throw var5;
        } catch (Exception var6) {
            throw new InternalAuthenticationServiceException(var6.getMessage(), var6);
        }
    }

    protected Authentication createSuccessAuthentication(Object principal, Authentication authentication, UserDetails user) {
        boolean upgradeEncoding = this.userDetailsPasswordService != null && this.passwordEncoder.upgradeEncoding(user.getPassword());
        if (upgradeEncoding) {
            String presentedPassword = authentication.getCredentials().toString();
            String newPassword = this.passwordEncoder.encode(presentedPassword);
            user = this.userDetailsPasswordService.updatePassword(user, newPassword);
        }

        return super.createSuccessAuthentication(principal, authentication, user);
    }

    public void setUserDetailsService(UserDetailsService userDetailsService) {
        this.userDetailsService = userDetailsService;
    }

    protected UserDetailsService getUserDetailsService() {
        return this.userDetailsService;
    }

    public void setUserDetailsPasswordService(UserDetailsPasswordService userDetailsPasswordService) {
        this.userDetailsPasswordService = userDetailsPasswordService;
    }
}

protected final UserDetails retrieveUser(String username, UsernamePasswordAuthenticationToken authentication)

UserDetails

public interface UserDetails extends Serializable {
    Collection<? extends GrantedAuthority> getAuthorities();

    String getPassword();

    String getUsername();

    boolean isAccountNonExpired();

    boolean isAccountNonLocked();

    boolean isCredentialsNonExpired();

    boolean isEnabled();
}

1. Authentication对象是用户POST进来的数据外加其他逻辑组成
2. UserDetails对象是由数据库取出来的对象外加其他逻辑组成

认证流程图