1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

private void doFilter(HttpServletRequest request, HttpServletResponse response, FilterChain chain)

throws IOException, ServletException {

if (!requiresAuthentication(request, response)) {

chain.doFilter(request, response);

return;

}

try {

Authentication authenticationResult = attemptAuthentication(request, response);

if (authenticationResult == null) {

// return immediately as subclass has indicated that it hasn't completed

return;

}

this.sessionStrategy.onAuthentication(authenticationResult, request, response);

// Authentication success

if (this.continueChainBeforeSuccessfulAuthentication) {

chain.doFilter(request, response);

}

successfulAuthentication(request, response, chain, authenticationResult);

}

catch (InternalAuthenticationServiceException failed) {

this.logger.error("An internal error occurred while trying to authenticate the user.", failed);

unsuccessfulAuthentication(request, response, failed);

}

catch (AuthenticationException ex) {

// Authentication failed

unsuccessfulAuthentication(request, response, ex);

}

}

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response)

throws AuthenticationException {

if (this.postOnly && !request.getMethod().equals("POST")) {

throw new AuthenticationServiceException("Authentication method not supported: " + request.getMethod());

}

String username = obtainUsername(request);

username = (username != null) ? username : "";

username = username.trim();

String password = obtainPassword(request);

password = (password != null) ? password : "";

UsernamePasswordAuthenticationToken authRequest = new UsernamePasswordAuthenticationToken(username, password);

// Allow subclasses to set the "details" property

setDetails(request, authRequest);

return this.getAuthenticationManager().authenticate(authRequest);

}

1

2

3

4

5

6

7

8

9

@Nullable

protected String obtainPassword(HttpServletRequest request) {

return request.getParameter(this.passwordParameter);

}

@Nullable

protected String obtainUsername(HttpServletRequest request) {

return request.getParameter(this.usernameParameter);

}

1

2

3

4

5

public WebAuthenticationDetails(HttpServletRequest request) {

this.remoteAddress = request.getRemoteAddr();

HttpSession session = request.getSession(false);

this.sessionId = (session != null) ? session.getId() : null;

}

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

75

76

77

78

79

80

81

82

83

84

85

86

87

88

89

@Override

public Authentication authenticate(Authentication authentication) throws AuthenticationException {

//获取Authentication的运行时类

Class<? extends Authentication> toTest = authentication.getClass();

AuthenticationException lastException = null;

AuthenticationException parentException = null;

Authentication result = null;

Authentication parentResult = null;

int currentPosition = 0;

int size = this.providers.size();

for (AuthenticationProvider provider : getProviders()) {

//判断是否支持处理该类别的provider

if (!provider.supports(toTest)) {

continue;

}

if (logger.isTraceEnabled()) {

logger.trace(LogMessage.format("Authenticating request with %s (%d/%d)",

provider.getClass().getSimpleName(), ++currentPosition, size));

}

try {

//获取用户的信息

result = provider.authenticate(authentication);

if (result != null) {

copyDetails(authentication, result);

break;

}

}

catch (AccountStatusException | InternalAuthenticationServiceException ex) {

prepareException(ex, authentication);

// SEC-546: Avoid polling additional providers if auth failure is due to

// invalid account status

throw ex;

}

catch (AuthenticationException ex) {

lastException = ex;

}

}

//不支持的话跳出循环再次执行

if (result == null && this.parent != null) {

// Allow the parent to try.

try {

parentResult = this.parent.authenticate(authentication);

result = parentResult;

}

catch (ProviderNotFoundException ex) {

// ignore as we will throw below if no other exception occurred prior to

// calling parent and the parent

// may throw ProviderNotFound even though a provider in the child already

// handled the request

}

catch (AuthenticationException ex) {

parentException = ex;

lastException = ex;

}

}

if (result != null) {

//擦除用户的凭证 也就是密码

if (this.eraseCredentialsAfterAuthentication && (result instanceof CredentialsContainer)) {

// Authentication is complete. Remove credentials and other secret data

// from authentication

((CredentialsContainer) result).eraseCredentials();

}

// If the parent AuthenticationManager was attempted and successful then it

// will publish an AuthenticationSuccessEvent

// This check prevents a duplicate AuthenticationSuccessEvent if the parent

// AuthenticationManager already published it

if (parentResult == null) {

//公示登陆成功

this.eventPublisher.publishAuthenticationSuccess(result);

}

return result;

}

// Parent was null, or didn't authenticate (or throw an exception).

if (lastException == null) {

lastException = new ProviderNotFoundException(this.messages.getMessage("ProviderManager.providerNotFound",

new Object[] { toTest.getName() }, "No AuthenticationProvider found for {0}"));

}

// If the parent AuthenticationManager was attempted and failed then it will

// publish an AbstractAuthenticationFailureEvent

// This check prevents a duplicate AbstractAuthenticationFailureEvent if the

// parent AuthenticationManager already published it

if (parentException == null) {

prepareException(lastException, authentication);

}

throw lastException;

}