通过源码分析Spring Security用户认证流程
Spring Security的登录主要是由一系列的过滤器组成，我们如果需要修改登录的校验逻辑，只需要在过滤器链路上添加修改相关的逻辑即可。这里主要通过Spring Security的源码来了解相关的认证登录的逻辑。
1.Spring Security的认证流程
主要分析：
- 认证用户的流程
- 如何进行认证校验
- 认证成功后怎么获取用户信息
具体的过滤器链路如下所示：
Spring Security的认证流程图如下，认证的主要过程有：
- 用户提交用户名和密码，然后通过UsernamePasswordAuthenticationFilter对其进行封装成为UsernamePasswordAuthenticationToken对象，这个是AbstractAuthenticationToken的子类，而AbstractAuthenticationToken又是Authentication的一个实现，所以可以看到后续获取的都是Authentication类型的对象实例；
- 将第一步的UsernamePasswordAuthenticationToken对象传递给AuthenticationManager；
- 通过AbstractUserDetailsAuthenticationProvider的默认实现类DaoAuthenticationProvider的retrieveUser方法，这个方法会调用UserDetailsService的loadUserByUsername方法来进行用户名和密码的判断，使用的默认的逻辑进行处理；
- 将成功认证后的用户信息放入到SecurityContextHolder中，之后可以通过SecurityContext获取用户的相关信息。
spring-security源码下载地址：
https://github.com/spring-projects/spring-security
2.Spring Security的认证源码分析
2.1 搭建项目并访问
首先我们搭建一个Spring Security的项目，使用Spring Boot可以很方便的进行集成开发，主要引入如下的依赖即可(当然也可以查看官网，选择合适的版本)：
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-security</artifactId>
</dependency>
启动项目后会随机生成一个密码串，这里需要复制保存以便登录的时候使用：
访问登录地址：
http://localhost:8080/login
默认的账户名和密码:
账户名: user
密码: 项目启动时生成的密码串
2.2 进行源码分析
-
进行断点后会发现首先进入的是UsernamePasswordAuthenticationFilter的attemptAuthentication(HttpServletRequest request, HttpServletResponse response)方法,会对用户名和密码进行封装成UsernamePasswordAuthenticationToken对象，然后调用this.getAuthenticationManager().authenticate(authRequest)方法进入到AuthenticationManager中。
attemptAuthentication方法源码如下所示：
@Override
public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response)
throws AuthenticationException {
if (this.postOnly && !request.getMethod().equals("POST")) {
throw new AuthenticationServiceException("Authentication method not supported: " + request.getMethod());
}
String username = obtainUsername(request);
username = (username != null) ? username : "";
username = username.trim();
String password = obtainPassword(request);
password = (password != null) ? password : "";
UsernamePasswordAuthenticationToken authRequest = new UsernamePasswordAuthenticationToken(username, password);
// Allow subclasses to set the "details" property
setDetails(request, authRequest);
return this.getAuthenticationManager().authenticate(authRequest);
}
-
随后请求进入到WebSecurityConfigurerAdapter的AuthenticationManagerDelegator中，AuthenticationManagerDelegator是AuthenticationManager的一个子类，最后封装成为UsernamePasswordAuthenticationToken对象，供DaoAuthenticationProvider使用。
AuthenticationManagerDelegator的源码如下：
static final class AuthenticationManagerDelegator implements AuthenticationManager { private AuthenticationManagerBuilder delegateBuilder; private AuthenticationManager delegate; private final Object delegateMonitor = new Object(); private Set<String> beanNames; AuthenticationManagerDelegator(AuthenticationManagerBuilder delegateBuilder, ApplicationContext context) { Assert.notNull(delegateBuilder, "delegateBuilder cannot be null"); Field parentAuthMgrField = ReflectionUtils.findField(AuthenticationManagerBuilder.class, "parentAuthenticationManager"); ReflectionUtils.makeAccessible(parentAuthMgrField); this.beanNames = getAuthenticationManagerBeanNames(context); validateBeanCycle(ReflectionUtils.getField(parentAuthMgrField, delegateBuilder), this.beanNames); this.delegateBuilder = delegateBuilder; } public Authentication authenticate(Authentication authentication) throws AuthenticationException { if (this.delegate != null) { return this.delegate.authenticate(authentication); } else { synchronized(this.delegateMonitor) { if (this.delegate == null) { this.delegate = (AuthenticationManager)this.delegateBuilder.getObject(); this.delegateBuilder = null; } } return this.delegate.authenticate(authentication); } } private static Set<String> getAuthenticationManagerBeanNames(ApplicationContext applicationContext) { String[] beanNamesForType = BeanFactoryUtils.beanNamesForTypeIncludingAncestors(applicationContext, AuthenticationManager.class); return new HashSet(Arrays.asList(beanNamesForType)); } private static void validateBeanCycle(Object auth, Set<String> beanNames) { if (auth != null && !beanNames.isEmpty() && auth instanceof Advised) { TargetSource targetSource = ((Advised)auth).getTargetSource(); if (targetSource instanceof LazyInitTargetSource) { LazyInitTargetSource lits = (LazyInitTargetSource)targetSource; if (beanNames.contains(lits.getTargetBeanName())) { throw new FatalBeanException("A dependency cycle was detected when trying to resolve the AuthenticationManager. Please ensure you have configured authentication."); } } } } }org.springframework.security.config.annotation.authentication.configuration.AuthenticationConfiguration.AuthenticationManagerDelegator#authenticate
@Override public Authentication authenticate(Authentication authentication) throws AuthenticationException { if (this.delegate != null) { return this.delegate.authenticate(authentication); } synchronized (this.delegateMonitor) { if (this.delegate == null) { this.delegate = this.delegateBuilder.getObject(); this.delegateBuilder = null; } } return this.delegate.authenticate(authentication); } -
进入到DaoAuthenticationProvider的retrieveUser(String username, UsernamePasswordAuthenticationToken authentication)方法进行用户的认证，这里的认证主要会调用默认的UserDetailsService对用户名和密码进行校验，如果是使用的类似于Mysql的数据源，其默认的实现是JdbcDaoImpl。
org.springframework.security.authentication.dao.DaoAuthenticationProvider#retrieveUser
@Override protected final UserDetails retrieveUser(String username, UsernamePasswordAuthenticationToken authentication) throws AuthenticationException { prepareTimingAttackProtection(); try { UserDetails loadedUser = this.getUserDetailsService().loadUserByUsername(username); if (loadedUser == null) { throw new InternalAuthenticationServiceException( "UserDetailsService returned null, which is an interface contract violation"); } return loadedUser; } catch (UsernameNotFoundException ex) { mitigateAgainstTimingAttack(authentication); throw ex; } catch (InternalAuthenticationServiceException ex) { throw ex; } catch (Exception ex) { throw new InternalAuthenticationServiceException(ex.getMessage(), ex); } } -
将上一步认证后的用户实例放入SecurityContextHolder中，至此我们可以很方便的从SecurityContextHolder中获取用户信息，方法如下：
Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
