Spring Acegi框架鉴权的实现 (1)

简单分析一下Spring Acegi的源代码实现：
Servlet.Filter的实现AuthenticationProcessingFilter启动Web页面的验证过程 - 在AbstractProcessingFilter定义了整个验证过程的模板：

代码

public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
    throws IOException, ServletException {
    //这里检验是不是符合ServletRequest/SevletResponse的要求
    if (!(request instanceof HttpServletRequest)) {
        throw new ServletException("Can only process HttpServletRequest");
     }

    if (!(response instanceof HttpServletResponse)) {
        throw new ServletException("Can only process HttpServletResponse");
     }

     HttpServletRequest httpRequest = (HttpServletRequest) request;
     HttpServletResponse httpResponse = (HttpServletResponse) response;
    //根据HttpServletRequest和HttpServletResponse来进行验证
    if (requiresAuthentication(httpRequest, httpResponse)) {
        if (logger.isDebugEnabled()) {
             logger.debug("Request is to process authentication");
         }
        //这里定义Acegi中的Authentication对象来持有相关的用户验证信息
         Authentication authResult;

        try {
             onPreAuthentication(httpRequest, httpResponse);
            //这里的具体验证过程委托给子类完成，比如AuthenticationProcessingFilter来完成基于Web页面的用户验证
             authResult = attemptAuthentication(httpRequest);
         } catch (AuthenticationException failed) {
            // Authentication failed
             unsuccessfulAuthentication(httpRequest, httpResponse, failed);

            return;
         }

        // Authentication success
        if (continueChainBeforeSuccessfulAuthentication) {
             chain.doFilter(request, response);
         }
        //完成验证后的后续工作，比如跳转到相应的页面
         successfulAuthentication(httpRequest, httpResponse, authResult);

        return;
     }

     chain.doFilter(request, response);
}

在AuthenticationProcessingFilter中的具体验证过程是这样的：

代码

public Authentication attemptAuthentication(HttpServletRequest request)
    throws AuthenticationException {
    //这里从HttpServletRequest中得到用户验证的用户名和密码
     String username = obtainUsername(request);
     String password = obtainPassword(request);

    if (username == null) {
         username = "";
     }

    if (password == null) {
         password = "";
     }
    //这里根据得到的用户名和密码去构造一个Authentication对象提供给AuthenticationManager进行验证，里面包含了用户的用户名和密码信息
     UsernamePasswordAuthenticationToken authRequest = new UsernamePasswordAuthenticationToken(username, password);

    // Place the last username attempted into HttpSession for views
     request.getSession().setAttribute(ACEGI_SECURITY_LAST_USERNAME_KEY, username);

    // Allow subclasses to set the "details" property
     setDetails(request, authRequest);
    //这里启动AuthenticationManager进行验证过程
    return this.getAuthenticationManager().authenticate(authRequest);
}

在Acegi框架中，进行验证管理的主要类是AuthenticationManager,我们看看它是怎样进行验证管理的 - 验证的调用入口是authenticate在AbstractAuthenticationManager的实现中：
//这是进行验证的函数，返回一个Authentication对象来记录验证的结果，其中包含了用户的验证信息，权限配置等，同时这个Authentication会以后被授权模块使用

代码

//如果验证失败，那么在验证过程中会直接抛出异常
    public final Authentication authenticate(Authentication authRequest)
        throws AuthenticationException {
        try {//这里是实际的验证处理，我们下面使用ProviderManager来说明具体的验证过程，传入的参数authRequest里面已经包含了从HttpServletRequest中得到的用户输入的用户名和密码
             Authentication authResult = doAuthentication(authRequest);
             copyDetails(authRequest, authResult);

            return authResult;
         } catch (AuthenticationException e) {
             e.setAuthentication(authRequest);
            throw e;
         }
     }

在ProviderManager中进行实际的验证工作，假设这里使用数据库来存取用户信息：

代码

public Authentication doAuthentication(Authentication authentication)
    throws AuthenticationException {
    //这里取得配置好的provider链的迭代器，在配置的时候可以配置多个provider,这里我们配置的是DaoAuthenticationProvider来说明, 它使用数据库来保存用户的用户名和密码信息。
     Iterator iter = providers.iterator();

     Class toTest = authentication.getClass();

     AuthenticationException lastException = null;

    while (iter.hasNext()) {
         AuthenticationProvider provider = (AuthenticationProvider) iter.next();

        if (provider.supports(toTest)) {
             logger.debug("Authentication attempt using " + provider.getClass().getName());
            //这个result包含了验证中得到的结果信息
             Authentication result = null;

            try {//这里是provider进行验证处理的过程
                 result = provider.authenticate(authentication);
                 sessionController.checkAuthenticationAllowed(result);
             } catch (AuthenticationException ae) {
                 lastException = ae;
                 result = null;
             }

            if (result != null) {
                 sessionController.registerSuccessfulAuthentication(result);
                 publishEvent(new AuthenticationSuccessEvent(result));

                return result;
             }
         }
     }

    if (lastException == null) {
         lastException = new ProviderNotFoundException(messages.getMessage("ProviderManager.providerNotFound",
                    new Object[] {toTest.getName()}, "No AuthenticationProvider found for {0}"));
     }

    // 这里发布事件来通知上下文的监听器
     String className = exceptionMappings.getProperty(lastException.getClass().getName());
     AbstractAuthenticationEvent event = null;

    if (className != null) {
        try {
             Class clazz = getClass().getClassLoader().loadClass(className);
             Constructor constructor = clazz.getConstructor(new Class[] {
                         Authentication.class, AuthenticationException.class
                     });
             Object obj = constructor.newInstance(new Object[] {authentication, lastException});
             Assert.isInstanceOf(AbstractAuthenticationEvent.class, obj, "Must be an AbstractAuthenticationEvent");
             event = (AbstractAuthenticationEvent) obj;
         } catch (ClassNotFoundException ignored) {}
        catch (NoSuchMethodException ignored) {}
        catch (IllegalAccessException ignored) {}
        catch (InstantiationException ignored) {}
        catch (InvocationTargetException ignored) {}
     }

    if (event != null) {
         publishEvent(event);
     } else {
        if (logger.isDebugEnabled()) {
             logger.debug("No event was found for the exception " + lastException.getClass().getName());
         }
     }

    // Throw the exception
    throw lastException;
}

我们下面看看在DaoAuthenticationProvider是怎样从数据库中取出对应的验证信息进行用户验证的，在它的基类AbstractUserDetailsAuthenticationProvider定义了验证的处理模板：