Spring源代码解析（九）：Spring Acegi框架鉴权的实现

publicvoid doFilter(ServletRequest request, ServletResponse response, FilterChain chain)

throws IOException, ServletException {

//这里检验是不是符合ServletRequest/SevletResponse的要求

if (!(request instanceof HttpServletRequest)) {

throw new ServletException("Can only process HttpServletRequest");

}

if (!(response instanceof HttpServletResponse)) {

throw new ServletException("Can only process HttpServletResponse");

}

HttpServletRequest httpRequest = (HttpServletRequest) request;

HttpServletResponse httpResponse = (HttpServletResponse) response;

//根据HttpServletRequest和HttpServletResponse来进行验证

if (requiresAuthentication(httpRequest, httpResponse)) {

if (logger.isDebugEnabled()) {

logger.debug("Request is to process authentication");

}

//这里定义Acegi中的Authentication对象来持有相关的用户验证信息

Authentication authResult;

try {

onPreAuthentication(httpRequest, httpResponse);

//这里的具体验证过程委托给子类完成，比如AuthenticationProcessingFilter来完成基于Web页面的用户验证

authResult = attemptAuthentication(httpRequest);

} catch (AuthenticationException failed) {

// Authentication failed

unsuccessfulAuthentication(httpRequest, httpResponse, failed);

return;

}

// Authentication success

if (continueChainBeforeSuccessfulAuthentication) {

chain.doFilter(request, response);

}

//完成验证后的后续工作，比如跳转到相应的页面

successfulAuthentication(httpRequest, httpResponse, authResult);

return;

}

chain.doFilter(request, response);

} public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException { //这里检验是不是符合ServletRequest/SevletResponse的要求 if (!(request instanceof HttpServletRequest)) { throw new ServletException("Can only process HttpServletRequest"); } if (!(response instanceof HttpServletResponse)) { throw new ServletException("Can only process HttpServletResponse"); } HttpServletRequest httpRequest = (HttpServletRequest) request; HttpServletResponse httpResponse = (HttpServletResponse) response; //根据HttpServletRequest和HttpServletResponse来进行验证 if (requiresAuthentication(httpRequest, httpResponse)) { if (logger.isDebugEnabled()) { logger.debug("Request is to process authentication"); } //这里定义Acegi中的Authentication对象来持有相关的用户验证信息 Authentication authResult; try { onPreAuthentication(httpRequest, httpResponse); //这里的具体验证过程委托给子类完成，比如AuthenticationProcessingFilter来完成基于Web页面的用户验证 authResult = attemptAuthentication(httpRequest); } catch (AuthenticationException failed) { // Authentication failed unsuccessfulAuthentication(httpRequest, httpResponse, failed); return; } // Authentication success if (continueChainBeforeSuccessfulAuthentication) { chain.doFilter(request, response); } //完成验证后的后续工作，比如跳转到相应的页面 successfulAuthentication(httpRequest, httpResponse, authResult); return; } chain.doFilter(request, response); }

在AuthenticationProcessingFilter中的具体验证过程是这样的：
Java代码



public Authentication attemptAuthentication(HttpServletRequest request)

throws AuthenticationException {

//这里从HttpServletRequest中得到用户验证的用户名和密码

String username = obtainUsername(request);

String password = obtainPassword(request);

if (username == null) {

username = "";

}

if (password == null) {

password = "";

}

//这里根据得到的用户名和密码去构造一个Authentication对象提供给AuthenticationManager进行验证，里面包含了用户的用户名和密码信息

UsernamePasswordAuthenticationToken authRequest = new UsernamePasswordAuthenticationToken(username, password);

// Place the last username attempted into HttpSession for views

request.getSession().setAttribute(ACEGI_SECURITY_LAST_USERNAME_KEY, username);

// Allow subclasses to set the "details" property

setDetails(request, authRequest);

//这里启动AuthenticationManager进行验证过程

return this.getAuthenticationManager().authenticate(authRequest);

} public Authentication attemptAuthentication(HttpServletRequest request) throws AuthenticationException { //这里从HttpServletRequest中得到用户验证的用户名和密码 String username = obtainUsername(request); String password = obtainPassword(request); if (username == null) { username = ""; } if (password == null) { password = ""; } //这里根据得到的用户名和密码去构造一个Authentication对象提供给AuthenticationManager进行验证，里面包含了用户的用户名和密码信息 UsernamePasswordAuthenticationToken authRequest = new UsernamePasswordAuthenticationToken(username, password); // Place the last username attempted into HttpSession for views request.getSession().setAttribute(ACEGI_SECURITY_LAST_USERNAME_KEY, username); // Allow subclasses to set the "details" property setDetails(request, authRequest); //这里启动AuthenticationManager进行验证过程 return this.getAuthenticationManager().authenticate(authRequest); }

在Acegi框架中，进行验证管理的主要类是AuthenticationManager,我们看看它是怎样进行验证管理的 - 验证的调用入口是authenticate在AbstractAuthenticationManager的实现中：
//这是进行验证的函数，返回一个Authentication对象来记录验证的结果，其中包含了用户的验证信息，权限配置等，同时这个Authentication会以后被授权模块使用
Java代码



//如果验证失败，那么在验证过程中会直接抛出异常

public final Authentication authenticate(Authentication authRequest)

throws AuthenticationException {

try {//这里是实际的验证处理，我们下面使用ProviderManager来说明具体的验证过程，传入的参数authRequest里面已经包含了从HttpServletRequest中得到的用户输入的用户名和密码

Authentication authResult = doAuthentication(authRequest);

copyDetails(authRequest, authResult);

return authResult;

} catch (AuthenticationException e) {

e.setAuthentication(authRequest);

throw e;

}

} //如果验证失败，那么在验证过程中会直接抛出异常 public final Authentication authenticate(Authentication authRequest) throws AuthenticationException { try {//这里是实际的验证处理，我们下面使用ProviderManager来说明具体的验证过程，传入的参数authRequest里面已经包含了从HttpServletRequest中得到的用户输入的用户名和密码 Authentication authResult = doAuthentication(authRequest); copyDetails(authRequest, authResult); return authResult; } catch (AuthenticationException e) { e.setAuthentication(authRequest); throw e; } }

在ProviderManager中进行实际的验证工作，假设这里使用数据库来存取用户信息：
Java代码



public Authentication doAuthentication(Authentication authentication)

throws AuthenticationException {

//这里取得配置好的provider链的迭代器，在配置的时候可以配置多个provider,这里我们配置的是DaoAuthenticationProvider来说明, 它使用数据库来保存用户的用户名和密码信息。

Iterator iter = providers.iterator();

Class toTest = authentication.getClass();

AuthenticationException lastException = null;

while (iter.hasNext()) {

AuthenticationProvider provider = (AuthenticationProvider) iter.next();

if (provider.supports(toTest)) {

logger.debug("Authentication attempt using " + provider.getClass().getName());

//这个result包含了验证中得到的结果信息

Authentication result = null;

try {//这里是provider进行验证处理的过程

result = provider.authenticate(authentication);

sessionController.checkAuthenticationAllowed(result);

} catch (AuthenticationException ae) {

lastException = ae;

result = null;

}

if (result != null) {

sessionController.registerSuccessfulAuthentication(result);

publishEvent(new AuthenticationSuccessEvent(result));

return result;

}

}

}

if (lastException == null) {

lastException = new ProviderNotFoundException(messages.getMessage("ProviderManager.providerNotFound",

new Object[] {toTest.getName()}, "No AuthenticationProvider found for {0}"));

}

// 这里发布事件来通知上下文的监听器

String className = exceptionMappings.getProperty(lastException.getClass().getName());

AbstractAuthenticationEvent event = null;