【权限管理系统】Spring security（三）---认证过程（原理解析，demo）

 AbstractAuthenticationProcessingFilter
    doFilter()(attemptAuthentication()获取Authentication实体)
        ->UsernamePasswordAuthenticationFilter（AbstractAuthenticationProcessingFilter的子类）
            attemptAuthentication() （在UsernamePasswordAuthenticationToken()中将username 和 password 生成 UsernamePasswordAuthenticationToken对象,getAuthenticationManager().authenticate进行认证以及返回获取Authentication实体）
                ->AuthenticationManager   
             ->ProviderManager()（AuthenticationManager接口实现）
                     authenticate()(AuthenticationProvider.authenticate()进行认证并获取Authentication实体)
                        ->AbstractUserDetailsAuthenticationProvider(内置缓存机制，如果缓存中没有用户信息就调用retrieveUser()获取用户)
                            authenticate()  (获取Authentication实体需要userDetails，在缓存中或者retrieveUser()获取userDetails；验证additionalAuthenticationChecks()；     createSuccessAuthentication()生成Authentication实体)
                ->DaoAuthenticationProvider
                    retrieveUser()  (调用自定义UserDetailsService中loadUserByUsername()加载userDetails)
                    ->UserDetailsService   
                        loadUserByUsername()（获取userDetails）

    public class UsernamePasswordAuthenticationFilter extends
        AbstractAuthenticationProcessingFilter {
        ....
        public Authentication attemptAuthentication(HttpServletRequest request,
            HttpServletResponse response) throws AuthenticationException {
            .....
            //1.创建拥有用户的详情信息的Authentication对象
        UsernamePasswordAuthenticationToken authRequest = new UsernamePasswordAuthenticationToken(
                username, password);
​
        // Allow subclasses to set the "details" property
        setDetails(request, authRequest);
                //2.AuthenticationManager进行认证
        return this.getAuthenticationManager().authenticate(authRequest);
    }
    ...
   }  

public class ProviderManager implements AuthenticationManager, MessageSourceAware,
    InitializingBean {
    ...
        public Authentication authenticate(Authentication authentication)
            throws AuthenticationException {
                ...
                //AuthenticationProvider依次进行认证
        for (AuthenticationProvider provider : getProviders()) {
                ...
            try {
                    //1.1进行认证，并返回Authentication对象
                result = provider.authenticate(authentication);
​
                if (result != null) {
                    copyDetails(authentication, result);
                    break;
                }
            }
                ...
            catch (AuthenticationException e) {
                lastException = e;
            }
        }
        if (result == null && parent != null) {
            // Allow the parent to try.
            try {
                    //1.2如果1.1认证中没有一个验证通过，则使用父类型AuthenticationManager进行验证
                result = parent.authenticate(authentication);
            }
            catch (ProviderNotFoundException e) {
                // ignore as we will throw below if no other exception occurred prior to
                // calling parent and the parent
                // may throw ProviderNotFound even though a provider in the child already
                // handled the request
            }
            catch (AuthenticationException e) {
                lastException = e;
            }
        }
                //2.从authentication中删除凭据和其他机密数据
        if (result != null) {
            if (eraseCredentialsAfterAuthentication
                    && (result instanceof CredentialsContainer)) {
                // Authentication is complete. Remove credentials and other secret data
                // from authentication
                ((CredentialsContainer) result).eraseCredentials();
            }
              //3.发布认证成功事件，并将Authentication对象保存到security context中
            eventPublisher.publishAuthenticationSuccess(result);
            return result;
        }
    }

 public abstract class AbstractUserDetailsAuthenticationProvider implements
        AuthenticationProvider, InitializingBean, MessageSourceAware {
        ...
        public Authentication authenticate(Authentication authentication)
        throws AuthenticationException {
                   ...
            boolean cacheWasUsed = true;
            //1.1获取缓存中UserDetails信息
            UserDetails user = this.userCache.getUserFromCache(username);
                  //1.2 如果缓存中没有信息，从UserDetailsService中获取
            if (user == null) {
                cacheWasUsed = false;
    
                try {
                        //使用DaoAuthenticationProvider中重写的方法去获取信息
                    user = retrieveUser(username,
                            (UsernamePasswordAuthenticationToken) authentication);
                }catch{
                ...
                }
                ...
            try {
                    //进行检验认证
                preAuthenticationChecks.check(user);
                additionalAuthenticationChecks(user,
                        (UsernamePasswordAuthenticationToken) authentication);
            }catch{
            ...
            }
                ...
            postAuthenticationChecks.check(user);
                   ....
                   // 将已通过验证的用户信息封装成 UsernamePasswordAuthenticationToken对象并返回
            return createSuccessAuthentication(principalToReturn, authentication, user);
    }

    protected final UserDetails retrieveUser(String username,
        UsernamePasswordAuthenticationToken authentication)
        throws AuthenticationException {
    prepareTimingAttackProtection();
    try {
            //根据UserDetailsService获取UserDetails信息，从自定义的UserDetailsService获取
        UserDetails loadedUser = this.getUserDetailsService().loadUserByUsername(username);
        if (loadedUser == null) {
            throw new InternalAuthenticationServiceException(
                    "UserDetailsService returned null, which is an interface contract violation");
        }
        return loadedUser;
    }
    catch (UsernameNotFoundException ex) {
        mitigateAgainstTimingAttack(authentication);
        throw ex;
    }
    catch (InternalAuthenticationServiceException ex) {
        throw ex;
    }
    catch (Exception ex) {
        throw new InternalAuthenticationServiceException(ex.getMessage(), ex);
    }
}

protected void additionalAuthenticationChecks(UserDetails userDetails,
        UsernamePasswordAuthenticationToken authentication)
        throws AuthenticationException {
    if (authentication.getCredentials() == null) {
        logger.debug("Authentication failed: no credentials provided");
​
        throw new BadCredentialsException(messages.getMessage(
                "AbstractUserDetailsAuthenticationProvider.badCredentials",
                "Bad credentials"));
    }
​
    String presentedPassword = authentication.getCredentials().toString();
        //进行密码验证
    if (!passwordEncoder.matches(presentedPassword, userDetails.getPassword())) {
        logger.debug("Authentication failed: password does not match stored value");
​
        throw new BadCredentialsException(messages.getMessage(
                "AbstractUserDetailsAuthenticationProvider.badCredentials",
                "Bad credentials"));
    }
}

public interface UserDetails extends Serializable {
    //1.权限集合
    Collection<? extends GrantedAuthority> getAuthorities();
    //2.密码  
    String getPassword();
    //3.用户名
    String getUsername();
    //4.用户是否过期
    boolean isAccountNonExpired();
    //5.是否锁定    
    boolean isAccountNonLocked();
    //6.用户密码是否过期    
    boolean isCredentialsNonExpired();
    //7.账号是否可用（可理解为是否删除）
    boolean isEnabled();
}

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {
  @Override
  protected void configure(HttpSecurity http) throws Exception {
        // TODO Auto-generated method stub
        //super.configure(http);
        http .csrf().disable()
             .authorizeRequests()
             .anyRequest().authenticated()
              .and()
             .formLogin()
                .loginPage("/login")
                .loginProcessingUrl("/login/form")
                .failureUrl("/login-error")
                .permitAll()  //表单登录，permitAll()表示这个不需要验证 登录页面，登录失败页面
              .and()
                .logout().permitAll();
        }
}

@service
public class CustomUserService implements UserDetailsService {
 @Autowired
 private UserInfoMapper userInfoMapper;
 @Autowired
 private PermissionInfoMapper permissionInfoMapper;
 @Autowired
 private BCryptPasswordEncoderService bCryptPasswordEncoderService;
  @Override
  public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        // TODO Auto-generated method stub
        //这里可以可以通过username（登录时输入的用户名）然后到数据库中找到对应的用户信息，并构建成我们自己的UserInfo来返回。
        UserInfoDTO user = userInfoMapper.getUserInfoByUserName(username);
         if (user != null) {
        List<PermissionInfoDTO> permissionInfoDTOS = permissionInfoMapper.findByAdminUserId(userInfo.getId());
        List<GrantedAuthority> grantedAuthorityList = new ArrayList<>();
        for (PermissionInfoDTO permissionInfoDTO : permissionInfoDTOS) {
            if (permissionInfoDTO != null && permissionInfoDTO.getPermissionName() != null) {
                GrantedAuthority grantedAuthority = new SimpleGrantedAuthority(
                        permissionInfoDTO.getPermissionName());
                grantedAuthorityList.add(grantedAuthority);
                 }
            }
             return new User(userInfo.getUserName(), bCryptPasswordEncoderService.encode(userInfo.getPasswaord()), grantedAuthorityList);
         }else {
        throw new UsernameNotFoundException("admin" + username + "do not exist");
         }
    }
}