Spring Security系列-Spring Security运行机制分析(四)

我不是女神ヾ 2022-01-27 04:15 186阅读 0赞

# 前言 #

前面三篇写的关于Spring Security是如何进行用户认证，本篇来看看我们输入的用户名和密码是如何传给AuthenticationManager的。

# Filter #

Spring Security有一个FilterChain，它包含由多个Filter组成的集合。当用户输入用户密码，并提交HttpRequest后，Spring Security通过一系列的Filter对HttpRequest进行处理和筛选。下面的图可以看出，Spring Security Filter Chain 作为Servlet Filter中的一个，但它包含了多个Filter。  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2NhbWVsODQ_size_16_color_FFFFFF_t_70]

# Configurer #

在org.springframework.security.config.annotation.web.configurers包下有许多configurer类。这些configurer类，都实现了configurer方法。当Spring Security初始化时，会根据代码中定义的Configurer配置或者properties文件中的配置，得到一个Configurer集合。集合中的每个Configurer类中的configurer方法被调用时，就可往SecurityFilterChain中添加相应的Filter。

之前在[Spring Security系列-Spring Security简单身份认证配置(二)][Spring Security_-Spring Security]中配置了的身份认证，它所使用的Configure以及生成的Filter如下：

<table> 
 <thead> 
  <tr> 
   <th align="left">Filters</th> 
   <th align="left">Configurers</th> 
  </tr> 
 </thead> 
 <tbody> 
  <tr> 
   <td align="left">org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter</td> 
   <td align="left">WebSecurityConfigurerAdapter直接添加</td> 
  </tr> 
  <tr> 
   <td align="left">org.springframework.security.web.context.SecurityContextPersistenceFilter</td> 
   <td align="left">SecurityContextConfigurer</td> 
  </tr> 
  <tr> 
   <td align="left">org.springframework.security.web.header.HeaderWriterFilter</td> 
   <td align="left">HeadersConfigurer</td> 
  </tr> 
  <tr> 
   <td align="left">org.springframework.security.web.csrf.CsrfFilter</td> 
   <td align="left">CsrfConfigurer</td> 
  </tr> 
  <tr> 
   <td align="left">org.springframework.security.web.authentication.logout.LogoutFilter</td> 
   <td align="left">LogoutConfigurer</td> 
  </tr> 
  <tr> 
   <td align="left">org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter</td> 
   <td align="left">FormLoginConfigurer</td> 
  </tr> 
  <tr> 
   <td align="left">org.springframework.security.web.savedrequest.RequestCacheAwareFilter</td> 
   <td align="left">RequestCacheConfigurer</td> 
  </tr> 
  <tr> 
   <td align="left">org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter</td> 
   <td align="left">ServletApiConfigurer</td> 
  </tr> 
  <tr> 
   <td align="left">org.springframework.security.web.authentication.AnonymousAuthenticationFilter</td> 
   <td align="left">AnonymousConfigurer</td> 
  </tr> 
  <tr> 
   <td align="left">org.springframework.security.web.session.SessionManagementFilter</td> 
   <td align="left">CsrfCoSessionManagementConfigurerfigurer</td> 
  </tr> 
  <tr> 
   <td align="left">org.springframework.security.web.access.ExceptionTranslationFilter</td> 
   <td align="left">ExceptionHandlingConfigurer</td> 
  </tr> 
  <tr> 
   <td align="left">org.springframework.security.web.access.intercept.FilterSecurityInterceptor</td> 
   <td align="left">ExpressionUrlAuthorizationConfigurer</td> 
  </tr> 
 </tbody> 
</table>

# Configurer中添加Filter #

下面是调用每个Configurer中的configure方法

public abstract class AbstractConfiguredSecurityBuilder<O, B extends SecurityBuilder<O>>
    		extends AbstractSecurityBuilder<O> { 
    	private void configure() throws Exception { 
    		Collection<SecurityConfigurer<O, B>> configurers = getConfigurers();
    
    		for (SecurityConfigurer<O, B> configurer : configurers) { 
    			configurer.configure((B) this);
    		}
    	}
    }

下面是类WebSecurityConfigurerAdapter中，加载默认的配置

http = new HttpSecurity(objectPostProcessor, authenticationBuilder,
    		sharedObjects);
    if (!disableDefaults) { 
    	// @formatter:off
    	http
    		.csrf().and()
    		.addFilter(new WebAsyncManagerIntegrationFilter())
    		.exceptionHandling().and()
    		.headers().and()
    		.sessionManagement().and()
    		.securityContext().and()
    		.requestCache().and()
    		.anonymous().and()
    		.servletApi().and()
    		.apply(new DefaultLoginPageConfigurer<>()).and()
    		.logout();
    	// @formatter:on
    	ClassLoader classLoader = this.context.getClassLoader();
    	List<AbstractHttpConfigurer> defaultHttpConfigurers =
    			SpringFactoriesLoader.loadFactories(AbstractHttpConfigurer.class, classLoader);
    
    	for (AbstractHttpConfigurer configurer : defaultHttpConfigurers) { 
    		http.apply(configurer);
    	}
    }

# UsernamePasswordAuthenticationFilter #

从UsernamePasswordAuthenticationFilter类中的，attemptAuthentication方法可以看到使用了AuthenticationManager的authenticate方法来验证HttpRequest中的username和password。看过上篇的读者应该记得，上篇我们的通过控制台输入的用户密码，然后进行验证，也是通过这种方式运行的。

public Authentication attemptAuthentication(HttpServletRequest request,
    		HttpServletResponse response) throws AuthenticationException { 
    	if (postOnly && !request.getMethod().equals("POST")) { 
    		throw new AuthenticationServiceException(
    				"Authentication method not supported: " + request.getMethod());
    	}
    
    	String username = obtainUsername(request);
    	String password = obtainPassword(request);
    
    	if (username == null) { 
    		username = "";
    	}
    
    	if (password == null) { 
    		password = "";
    	}
    
    	username = username.trim();
    
    	UsernamePasswordAuthenticationToken authRequest = new UsernamePasswordAuthenticationToken(
    			username, password);
    
    	// Allow subclasses to set the "details" property
    	setDetails(request, authRequest);
    
    	return this.getAuthenticationManager().authenticate(authRequest);
    }

[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2NhbWVsODQ_size_16_color_FFFFFF_t_70]: /images/20220127/9b5f6701b1344ca28625cacf73db5a46.png
[Spring Security_-Spring Security]: https://blog.csdn.net/camel84/article/details/89819387