利用断点走了一遍spring-security源码的核心部分，下面根据自己的理解对源码做了一些解释，过滤器开头的标号是运行时默认配置调用的顺序，理解了原理，我们可以通过继承和实现接口的方式扩展过滤器，权限验证器，数据查询器，投票器等等……
1.SecurityContextPersistenceFilter 从HttpSession中获取SecurityContext上下文
2.logoutFilter 如果访问地址为/j_spring_security_logout，LogoutFilter将注销用户
3.AbstractAuthenticationProcessingFilter 权限管理器如果访问地址为/j_spring_security_check则选择对应的数据查询器来获取存储的用户相关信息
4.BasicAuthenticationFilter
5.RequestCacheAwareFilter
6.SecurityContextHolderAwareRequestFilter
7.RememberMeAuthenticationFilter 如果当前SecurityContextHolder中没有用户对象，则通过cookie查找
8.AnonymousAuthenticationFilter 如果当前SecurityContextHolder中没有用户对象，则创建匿名对象
9.SessionManagementFilter 检查session是否超时
10.ExceptionTranslationFilter 调用FilterSecurityInterceptor，AbstractSecurityInterceptor使用投票器进行权限判断
11.SwitchUserFilter 用户切换高权限用户向低权限用户切换
//从HttpSession中获取SecurityContext上下文
public class SecurityContextPersistenceFilter extends GenericFilterBean {
private SecurityContextRepository repo = new HttpSessionSecurityContextRepository();
public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain)
throws IOException, ServletException {
//代码略.....................
HttpRequestResponseHolder holder = new HttpRequestResponseHolder(request, response);
SecurityContext contextBeforeChainExecution = repo.loadContext(holder);//获得security上下文
try {
SecurityContextHolder.setContext(contextBeforeChainExecution);
chain.doFilter(holder.getRequest(), holder.getResponse());//调用下一个过滤器
} finally {
SecurityContext contextAfterChainExecution = SecurityContextHolder.getContext();
// Crucial removal of SecurityContextHolder contents - do this before anything else.
SecurityContextHolder.clearContext();
repo.saveContext(contextAfterChainExecution, holder.getRequest(), holder.getResponse());
request.removeAttribute(FILTER_APPLIED);
}
}
//代码略.....................
}
//如果访问地址为/j_spring_security_logout，LogoutFilter将注销用户
public class LogoutFilter extends GenericFilterBean {
private String filterProcessesUrl = "/j_spring_security_logout";
//代码略.....................
public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain)
throws IOException, ServletException {
//判断如果访问地址为/j_spring_security_logout则执行注销，否则跳过
if (requiresLogout(request, response)) {
Authentication auth = SecurityContextHolder.getContext().getAuthentication();
for (LogoutHandler handler : handlers) {
handler.logout(request, response, auth);
}
logoutSuccessHandler.onLogoutSuccess(request, response, auth);
return;
}
chain.doFilter(request, response);
}
//代码略.....................
}
//权限管理器如果访问地址为/j_spring_security_check则选择对应的数据查询器来获取存储的用户相关信息
public abstract class AbstractAuthenticationProcessingFilter extends GenericFilterBean implements
ApplicationEventPublisherAware, MessageSourceAware {
//代码略.....................
public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain)
throws IOException, ServletException {
//判断如果访问地址为/j_spring_security_check则跳过进行权限获取和判断，否则执行AnonymousAuthenticationFilter
if (!requiresAuthentication(request, response)) {
chain.doFilter(request, response); //调用下一个过滤器BasicAuthenticationFilter
return;
}
Authentication authResult;
try {
//执行UsernamePasswordAuthenticationFilter类中的方法
authResult = attemptAuthentication(request, response);
if (authResult == null) {
// return immediately as subclass has indicated that it hasn't completed authentication
return;
}
sessionStrategy.onAuthentication(authResult, request, response);
}
catch (AuthenticationException failed) {
// Authentication failed
unsuccessfulAuthentication(request, response, failed);
return;
}
// Authentication success
if (continueChainBeforeSuccessfulAuthentication) {
chain.doFilter(request, response);
}
successfulAuthentication(request, response, authResult);
}
protected void successfulAuthentication(HttpServletRequest request, HttpServletResponse response,
Authentication authResult) throws IOException, ServletException {
SecurityContextHolder.getContext().setAuthentication(authResult);
rememberMeServices.loginSuccess(request, response, authResult); //是否存入cookie
// Fire event
if (this.eventPublisher != null) {
eventPublisher.publishEvent(new InteractiveAuthenticationSuccessEvent(authResult, this.getClass()));
}
successHandler.onAuthenticationSuccess(request, response, authResult);//跳转到目标页面
}
//代码略.....................
}
public class UsernamePasswordAuthenticationFilter extends AbstractAuthenticationProcessingFilter {
//代码略.....................
public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response) throws AuthenticationException {
if (postOnly && !request.getMethod().equals("POST")) {
throw new AuthenticationServiceException("Authentication method not supported: " + request.getMethod());
}
//获取页面提交的用户名、密码
String username = obtainUsername(request);
String password = obtainPassword(request);
username = username.trim();
//封装成token对象
UsernamePasswordAuthenticationToken authRequest = new UsernamePasswordAuthenticationToken(username, password);
//代码略.....................
//调用AbstractAuthenticationManager类中的方法
return this.getAuthenticationManager().authenticate(authRequest);
}
//代码略.....................
}
public abstract class AbstractAuthenticationManager implements AuthenticationManager {
//代码略.....................
public final Authentication authenticate(Authentication authRequest) throws AuthenticationException {
try {
return doAuthentication(authRequest);//调用ProviderManager类中的方法
} catch (AuthenticationException e) {
e.setAuthentication(authRequest);
if (clearExtraInformation) {
e.clearExtraInformation();
}
throw e;
}
}
//代码略.....................
}
//权限认证管理器
public class ProviderManager extends AbstractAuthenticationManager implements MessageSourceAware, InitializingBean {
private List providers = Collections.emptyList();
private AuthenticationManager parent;
//代码略.....................
public Authentication doAuthentication(Authentication authentication) throws AuthenticationException {
Class extends Authentication> toTest = authentication.getClass();
AuthenticationException lastException = null;
Authentication result = null;
for (AuthenticationProvider provider : getProviders()) {
if (!provider.supports(toTest)) {
continue;
}
try {
//调用AbstractUserDetailsAuthenticationProvider类中的方法
result = provider.authenticate(authentication);
if (result != null) {
copyDetails(authentication, result);
break;
}
} catch (AccountStatusException e) {
// SEC-546: Avoid polling additional providers if auth failure is due to invalid account status
eventPublisher.publishAuthenticationFailure(e, authentication);
throw e;
} catch (AuthenticationException e) {
lastException = e;
}
}
if (result == null && parent != null) {
// Allow the parent to try.
try {
result = parent.authenticate(authentication);
} catch (ProviderNotFoundException e) {
// ignore as we will throw below if no other exception occurred prior to calling parent and the parent
// may throw ProviderNotFound even though a provider in the child already handled the request
} catch (AuthenticationException e) {
lastException = e;
}
}
if (result != null) {
if (eraseCredentialsAfterAuthentication && (result instanceof CredentialsContainer)) {
// Authentication is complete. Remove credentials and other secret data from authentication
((CredentialsContainer)result).eraseCredentials();
}
eventPublisher.publishAuthenticationSuccess(result);
return result;
}
eventPublisher.publishAuthenticationFailure(lastException, authentication);
throw lastException;
}
//代码略.....................
}
//权限查询器
public abstract class AbstractUserDetailsAuthenticationProvider implements AuthenticationProvider, InitializingBean,
MessageSourceAware {
//代码略.....................
public Authentication authenticate(Authentication authentication) throws AuthenticationException {
Assert.isInstanceOf(UsernamePasswordAuthenticationToken.class, authentication,
messages.getMessage("AbstractUserDetailsAuthenticationProvider.onlySupports",
"Only UsernamePasswordAuthenticationToken is supported"));
// Determine username
String username = (authentication.getPrincipal() == null) ? "NONE_PROVIDED" : authentication.getName();
boolean cacheWasUsed = true;
UserDetails user = this.userCache.getUserFromCache(username); //从Ehcache实现的缓存里取userDetail对象
if (user == null) {
cacheWasUsed = false;
try {
//调用DaoAuthenticationProvider类中的方法
user = retrieveUser(username, (UsernamePasswordAuthenticationToken) authentication);
} catch (UsernameNotFoundException notFound) {
logger.debug("User '" + username + "' not found");
if (hideUserNotFoundExceptions) {
throw new BadCredentialsException(messages.getMessage(
"AbstractUserDetailsAuthenticationProvider.badCredentials", "Bad credentials"));
} else {
throw notFound;
}
}
Assert.notNull(user, "retrieveUser returned null - a violation of the interface contract");
}
try {
preAuthenticationChecks.check(user); //检查用户是否有效
//通过页面传入的用户名、密码和数据库中取出的信息对比验证
additionalAuthenticationChecks(user, (UsernamePasswordAuthenticationToken) authentication);
} catch (AuthenticationException exception) {
if (cacheWasUsed) {
// There was a problem, so try again after checking
// we're using latest data (i.e. not from the cache)
cacheWasUsed = false;
user = retrieveUser(username, (UsernamePasswordAuthenticationToken) authentication);
preAuthenticationChecks.check(user);
additionalAuthenticationChecks(user, (UsernamePasswordAuthenticationToken) authentication);
} else {
throw exception;
}
}
postAuthenticationChecks.check(user);
if (!cacheWasUsed) {
this.userCache.putUserInCache(user); //将用户对象放入缓存
}
Object principalToReturn = user;
if (forcePrincipalAsString) {
principalToReturn = user.getUsername();
}
return createSuccessAuthentication(principalToReturn, authentication, user);
}
//代码略.....................
}
//数据库查询器
class DaoAuthenticationProvider extends AbstractUserDetailsAuthenticationProvider{
private UserDetailsService userDetailsService;
//代码略.....................
protected final UserDetails retrieveUser(String username, UsernamePasswordAuthenticationToken authentication)
throws AuthenticationException {
UserDetails loadedUser;
try {
//获取用户信息，可以通过实现UserDetailsService接口或继承JdbcDaoImpl类来自定义内部实现
loadedUser = this.getUserDetailsService().loadUserByUsername(username);//调用自定义类UserDetailsServiceImpl的方法
}
catch (DataAccessException repositoryProblem) {
throw new AuthenticationServiceException(repositoryProblem.getMessage(), repositoryProblem);
}
if (loadedUser == null) {
throw new AuthenticationServiceException(
"UserDetailsService returned null, which is an interface contract violation");
}
return loadedUser;
}
protected void additionalAuthenticationChecks(UserDetails userDetails,
UsernamePasswordAuthenticationToken authentication) throws AuthenticationException {
Object salt = null;
if (this.saltSource != null) {
salt = this.saltSource.getSalt(userDetails);
}
if (authentication.getCredentials() == null) {
logger.debug("Authentication failed: no credentials provided");
throw new BadCredentialsException(messages.getMessage(
"AbstractUserDetailsAuthenticationProvider.badCredentials", "Bad credentials"),
includeDetailsObject ? userDetails : null);
}
String presentedPassword = authentication.getCredentials().toString();
//判断密码是否一致
if (!passwordEncoder.isPasswordValid(userDetails.getPassword(), presentedPassword, salt)) {
logger.debug("Authentication failed: password does not match stored value");
throw new BadCredentialsException(messages.getMessage(
"AbstractUserDetailsAuthenticationProvider.badCredentials", "Bad credentials"),
includeDetailsObject ? userDetails : null);
}
}
//代码略.....................
}
//自定义类实现查询接口
public class UserDetailsServiceImpl extends JdbcDaoSupport implements UserDetailsService {
private String authoritiesByUsernameQuery;
private String usersByUsernameQuery;
//代码略.....................
public void setAuthoritiesByUsernameQuery(String queryString) {
authoritiesByUsernameQuery = queryString;
}
public void setUsersByUsernameQuery(String usersByUsernameQueryString) {
this.usersByUsernameQuery = usersByUsernameQueryString;
}
@Override
public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException, DataAccessException {
List users = loadUsersByUsername(username); //访问数据库查询用户信息
if (users.size() == 0) {
logger.debug("Query returned no results for user '" + username + "'");
throw new UsernameNotFoundException(
messages.getMessage("JdbcDaoImpl.notFound", new Object[]{username}, "Username {0} not found"), username);
}
UserDetails user = users.get(0); // contains no GrantedAuthority[]
Set dbAuthsSet = new HashSet();
if (enableAuthorities) {
dbAuthsSet.addAll(loadUserAuthorities(user.getUsername())); //查询用户拥有的角色
}
if (enableGroups) {
dbAuthsSet.addAll(loadGroupAuthorities(user.getUsername()));
}
List dbAuths = new ArrayList(dbAuthsSet);
addCustomAuthorities(user.getUsername(), dbAuths);
if (dbAuths.size() == 0) {
logger.debug("User '" + username + "' has no authorities and will be treated as 'not found'");
throw new UsernameNotFoundException(
messages.getMessage("JdbcDaoImpl.noAuthority",
new Object[] {username}, "User {0} has no GrantedAuthority"), username);
}
return createUserDetails(username, user, dbAuths);//返回实现UserDetails接口的对象，将验证信息封装到此对象中
}
protected List loadUsersByUsername(String username) {
return getJdbcTemplate().query(usersByUsernameQuery, new String[]{
username}, new RowMapper() {
@Override
public UserDetails mapRow(ResultSet rs, int rowNum) throws SQLException {
String username = rs.getString(1);
String password = rs.getString(2);
boolean enabled = rs.getBoolean(3);
return new userDetailsImpl(username, password, enabled);//返回实现UserDetails接口的对象
}
});
}
//代码略.....................
}
//用户信息bean，必须实现UserDetails接口
public class userDetailsImpl implements UserDetails {
//代码略.....................
}
//由ExceptionTranslationFilter过滤器调用来进行权限判断
public abstract class AbstractSecurityInterceptor implements InitializingBean, ApplicationEventPublisherAware,
MessageSourceAware {
//代码略.....................
protected InterceptorStatusToken beforeInvocation(Object object) {
//这里读取配置FilterSecurityInterceptor的SecurityMetadataSource属性来获取配置的角色，这些属性配置了资源的安全设置
Collection attributes = this.obtainSecurityMetadataSource().getAttributes(object);
if (attributes == null) {
if (rejectPublicInvocations) {
throw new IllegalArgumentException("Secure object invocation " + object +
" was denied as public invocations are not allowed via this interceptor. "
+ "This indicates a configuration error because the "
+ "rejectPublicInvocations property is set to 'true'");
}
publishEvent(new PublicInvocationEvent(object));
return null; // no further work post-invocation
}
//这里从SecurityContextHolder中去取Authentication对象，一般在登录时会放到SecurityContextHolder中去
if (SecurityContextHolder.getContext().getAuthentication() == null) {
credentialsNotFound(messages.getMessage("AbstractSecurityInterceptor.authenticationNotFound",
"An Authentication object was not found in the SecurityContext"), object, attributes);
}
// 如果前面没有处理鉴权，这里需要对鉴权进行处理
Authentication authenticated = authenticateIfRequired();
// Attempt authorization
try {
//通过投票器判断当前角色是否有权限访问该地址，如果没有权限则抛出异常，调用AffirmativeBased类中的decide的方法
this.accessDecisionManager.decide(authenticated, object, attributes);
}
catch (AccessDeniedException accessDeniedException) {
//授权不成功向外发布事件
publishEvent(new AuthorizationFailureEvent(object, attributes, authenticated,
accessDeniedException));
throw accessDeniedException;
}
publishEvent(new AuthorizedEvent(object, attributes, authenticated));
// 这里构建一个RunAsManager来替代当前的Authentication对象，默认情况下使用的是NullRunAsManager会把SecurityContextHolder中的Authentication对象清空
Authentication runAs = this.runAsManager.buildRunAs(authenticated, object, attributes);
if (runAs == null) {
// no further work post-invocation
return new InterceptorStatusToken(authenticated, false, attributes, object);
} else {
SecurityContextHolder.getContext().setAuthentication(runAs);
// need to revert to token.Authenticated post-invocation
return new InterceptorStatusToken(authenticated, true, attributes, object);
}
}
//代码略.....................
}
//决策器
public class AffirmativeBased extends AbstractAccessDecisionManager {
//代码略.....................
public void decide(Authentication authentication, Object object, Collection configAttributes)
throws AccessDeniedException {
int deny = 0;
//依次使用各个投票器进行投票，并对投票结果进行计票
for (AccessDecisionVoter voter : getDecisionVoters()) {
int result = voter.vote(authentication, object, configAttributes);
if (logger.isDebugEnabled()) {
logger.debug("Voter: " + voter + ", returned: " + result);
}
//这是对投票结果进行处理，如果遇到其中一票通过，那就授权通过，如果是弃权或者反对，那就继续投票
switch (result) {
case AccessDecisionVoter.ACCESS_GRANTED: //result:1
return;
case AccessDecisionVoter.ACCESS_DENIED: //result:-1
//这里对反对票进行计数
deny++;
break;
default:
break;
}
}
//如果有反对票，抛出异常，整个授权不通过
if (deny > 0) {
throw new AccessDeniedException(messages.getMessage("AbstractAccessDecisionManager.accessDenied",
"Access is denied"));
}
//这里对弃权票进行处理，看看是全是弃权票的决定情况，默认是不通过，由allowIfAllAbstainDecisions变量控制
checkAllowIfAllAbstainDecisions();
}
//代码略.....................
}
//角色投票器
public class RoleVoter implements AccessDecisionVoter {
//代码略.....................
public int vote(Authentication authentication, Object object, Collection attributes) {
int result = ACCESS_ABSTAIN;
Collection authorities = extractAuthorities(authentication);
for (ConfigAttribute attribute : attributes) {//这里取得资源的安全配置
if (this.supports(attribute)) {
result = ACCESS_DENIED;
//这里对资源配置的安全授权级别进行判断，也就是匹配ROLE为前缀的角色配置
//遍历每个配置属性，如果其中一个匹配该主体持有的GrantedAuthority,则访问被允许。
//当前用户拥有的角色集合,当有任何一个角色满足时授予权限
for (GrantedAuthority authority : authorities) {
if (attribute.getAttribute().equals(authority.getAuthority())) {
return ACCESS_GRANTED;
}
}
}
}
return result;
}
Collection extractAuthorities(Authentication authentication) {
return authentication.getAuthorities();
}
//代码略.....................
}