第一步
Spring Security对于获取TOKEN的请求（/oauth/token）,需要认证client_id和client_secret。认证client_id和client_secret可以有2种方式，一种是通过 ClientCredentialsTokenEndpointFilter，另一种是通过BasicAuthenticationFilter。
ClientCredentialsTokenEndpointFilter 继承自 AbstractAuthenticationProcessingFilter，调用授权接口获取token值的请求（/oauth/token）需要认证client_id和client_secret。该请求会被 AbstractAuthenticationProcessingFilter 过滤器拦截，执行父类的doFilter() 方法：
public abstract class AbstractAuthenticationProcessingFilter extends GenericFilterBean
implements ApplicationEventPublisherAware, MessageSourceAware {
public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain)
throws IOException, ServletException {
HttpServletRequest request = (HttpServletRequest) req;
HttpServletResponse response = (HttpServletResponse) res;
// 判断是否需要认证：判断url是否为与配置的获取access token的url进行匹配
if (!requiresAuthentication(request, response)) {
chain.doFilter(request, response);
return;
}
Authentication authResult;
try {
// 调用实现类中的attemptAuthentication方法认证
authResult = attemptAuthentication(request, response);
if (authResult == null) {
return;
}
// session存储
sessionStrategy.onAuthentication(authResult, request, response);
}catch (InternalAuthenticationServiceException failed) {
// 认证失败处理
unsuccessfulAuthentication(request, response, failed);
return;
}catch (AuthenticationException failed) {
// Authentication failed
unsuccessfulAuthentication(request, response, failed);
return;
}
// Authentication success
if (continueChainBeforeSuccessfulAuthentication) {
chain.doFilter(request, response);
}
// 回调认证成功的自定义处理逻辑
successfulAuthentication(request, response, chain, authResult);
}
protected boolean requiresAuthentication(HttpServletRequest request,
HttpServletResponse response) {
return requiresAuthenticationRequestMatcher.matches(request);
}
}
requiresAuthentication(request, response) 最终会调用 ClientCredentialsTokenEndpointFilter 中内部类 ClientCredentialsRequestMatcher#matches 方法：
@Deprecated
public class ClientCredentialsTokenEndpointFilter extends AbstractAuthenticationProcessingFilter {
// ...
// 内部类
protected static class ClientCredentialsRequestMatcher implements RequestMatcher {
// /oauth/token
private String path;
public ClientCredentialsRequestMatcher(String path) {
this.path = path;
}
// 判断请求的 url 与获取 access token 的默认 url(/oauth/token)是否一致
// 判断 client_id 是否为空
public boolean matches(HttpServletRequest request) {
// 请你路径uri : /ngsoc/AUTH/oauth/token
String uri = request.getRequestURI();
int pathParamIndex = uri.indexOf(59);
if (pathParamIndex > 0) {
uri = uri.substring(0, pathParamIndex);
}
// ngsoc
String clientId = request.getParameter("client_id");
if (clientId == null) {
return false;
} else {
// 服务路径 request.getContextPath() : /ngosc/AUTH
// path : /oauth/token
return "".equals(request.getContextPath()) ? uri.endsWith(this.path) : uri.endsWith(request.getContextPath() + this.path);
}
}
}
}
第二步
当认证请求需要被认证时，authResult = attemptAuthentication(request, response); 就会调用子类ClientCredentialsTokenEndpointFilter#attemptAuthentication 方法，在方法中将参数中的client_id和client_sercet封装成Authentication对象UsernamePasswordAuthenticationToken，然后交给AuthenticationManager的实现类去认证。
@Deprecated
public class ClientCredentialsTokenEndpointFilter extends AbstractAuthenticationProcessingFilter {
private AuthenticationEntryPoint authenticationEntryPoint;
private boolean allowOnlyPost;
public Authentication attemptAuthentication(HttpServletRequest request,
HttpServletResponse response) throws AuthenticationException, IOException, ServletException {
// 如果不是post请求，抛出异常
if (this.allowOnlyPost && !"POST".equalsIgnoreCase(request.getMethod())) {
throw new HttpRequestMethodNotSupportedException(request.getMethod(), new String[]{
"POST"});
} else {
// 从请求参数client_id中获取clientId
String clientId = request.getParameter("client_id"); // ngsoc
// 从请求参数client_secret中获取clientSecret
String clientSecret = request.getParameter("client_secret"); // ngsoc
// 从SecurityContextHolder中获取认证成功的认证用户信息，如果不为空，直接返回
Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
if (authentication != null && authentication.isAuthenticated()) {
return authentication;
} else if (clientId == null) {
throw new BadCredentialsException("No client credentials presented");
} else {
if (clientSecret == null) {
clientSecret = "";
}
clientId = clientId.trim();
// 将clientId和clientSecret封装为UsernamePasswordAuthenticationToken对象
UsernamePasswordAuthenticationToken authRequest
= new UsernamePasswordAuthenticationToken(clientId, clientSecret);
// 将UsernamePasswordAuthenticationToken交给AuthenticationManager的子类认证
return this.getAuthenticationManager().authenticate(authRequest);
}
}
}
}
第三步
AuthenticationManager接口源码：
public interface AuthenticationManager {
// 身份认证
// 请求数据：待认证的 Authentication
// 响应数据：认证成功的 Authentication
Authentication authenticate(Authentication authentication) throws AuthenticationException;
}
AuthenticationManager接口的默认实现类是ProviderManager，因此this.getAuthenticationManager().authenticate(authRequest) 最终会调用ProviderManager#authenticate方法完成认证。
public class ProviderManager implements AuthenticationManager, MessageSourceAware,
InitializingBean {
// AuthenticationProvider列表
private List<AuthenticationProvider> providers = Collections.emptyList();
// 父类的 AuthenticationManager
private AuthenticationManager parent;
public Authentication authenticate(Authentication authentication)
throws AuthenticationException {
Class<? extends Authentication> toTest = authentication.getClass();
Authentication result = null;
Authentication parentResult = null;
// 遍历AuthenticationProvider列表
for (AuthenticationProvider provider : getProviders()) {
// 判断当前遍历 AuthenticationProvider 是否支持Authentication对象的认证
if (!provider.supports(toTest)) {
continue;
}
try {
// 如果支持，将使用该AuthenticationProvider完成认证
result = provider.authenticate(authentication);
if (result != null) {
copyDetails(authentication, result);
break;
}
}
// ....
}
if (result == null && parent != null) {
// Allow the parent to try.
try {
result = parentResult = parent.authenticate(authentication);
} catch (ProviderNotFoundException e) {
}catch (AuthenticationException e) {
lastException = parentException = e;
}
}
// ...
}
}
说明：
在Spring Seourity 中，允许系统同时⽀持多种不同的认证⽅式，例如同时⽀持⽤户名/密码认证、 ReremberMe 认证、⼿机号码动态认证等，⽽不同的认证⽅式对应了不同的 AuthenticationProvider，所以⼀个完整的认证流程可能由多个AuthenticationProvider 来提供。
多个AuthenticationProvider将组成⼀个列表，这个列表将由ProviderManager 代理。换句话说，在ProviderManager 中存在⼀个AuthenticationProvider列表，在ProviderManager中遍历列表中的每⼀个AuthenticationProvider去执⾏身份认证，最终得到认证结果。
ProviderManager 本身也可以再配置⼀个 AuthenticationManager 作为parent，这样当ProviderManager 认证失败之后，就可以进⼊到 parent 中再次进⾏认证。理论上来说， ProviderManager 的 parent 可以是任意类型的AuthenticationManager，但是通常都是由ProviderManager 来扮演 parent 的⻆⾊，也就是 ProviderManager 是ProviderManager 的 parent。
默认情况下，ProviderManager的AuthenticationProvider列表中包含两个实现类：AnoymousAuthenticationProvider 和DaoAuthenticationProvider。
for循环内第一次得到AnoymousAuthenticationProvider，执行AnonymousAuthenticationProvider#supports方法判断该类是否支持UsernamePasswordAuthenticationToken类型的认证，结果不支持，代码如下：
public class AnonymousAuthenticationProvider implements AuthenticationProvider,
MessageSourceAware {
public boolean supports(Class<?> authentication) {
return (AnonymousAuthenticationToken.class.isAssignableFrom(authentication));
}
}
for循环内第二次得到DaoAuthenticationProvider，该类继承自AbstractUserDetailsAuthenticationProvider类，会调用AbstractUserDetailsAuthenticationProvider#supports方法判断该类是否支持UsernamePasswordAuthenticationToken类型的认证，结果支持。
public abstract class AbstractUserDetailsAuthenticationProvider implements
AuthenticationProvider, InitializingBean, MessageSourceAware {
public boolean supports(Class<?> authentication) {
return (UsernamePasswordAuthenticationToken.class
.isAssignableFrom(authentication));
}
}
因此 result = provider.authenticate(authentication) 最终会调用AbstractUserDetailsAuthenticationProvider#authenticate方法对UsernamePasswordAuthenticationToken对象完成认证，在该方法中根据clientId获取数据源中存储的用户user，然后判断user是否禁用、过期、锁定、密码是否一致等，若都满足条件则验证通过。
public abstract class AbstractUserDetailsAuthenticationProvider implements
AuthenticationProvider, InitializingBean, MessageSourceAware {
public Authentication authenticate(Authentication authentication)
throws AuthenticationException {
// Determine username
String username = (authentication.getPrincipal() == null) ? "NONE_PROVIDED"
: authentication.getName();
boolean cacheWasUsed = true;
// 从缓存中根据clientId获取UserDetails对象
UserDetails user = this.userCache.getUserFromCache(username);
// 如果缓存中获取不到
if (user == null) {
cacheWasUsed = false;
try {
// 从数据源中获取
user = retrieveUser(username,
(UsernamePasswordAuthenticationToken) authentication);
}catch (UsernameNotFoundException notFound) {
// 如果根据clientId从数据源中获取UserDetails用户详情，如果为空，认证失败抛出异常
logger.debug("User '" + username + "' not found");
if (hideUserNotFoundExceptions) {
throw new BadCredentialsException(messages.getMessage(
"AbstractUserDetailsAuthenticationProvider.badCredentials",
"Bad credentials"));
}
else {
throw notFound;
}
}
}
try {
// 检查账户是否锁定、启用、过期等
pr eAuthenticationChecks.check(user);
//检查凭据[密码]是否非空、以及存储密码与输入密码是否一致
additionalAuthenticationChecks(user,
(UsernamePasswordAuthenticationToken) authentication);
}
catch (AuthenticationException exception) {
if (cacheWasUsed) {
cacheWasUsed = false;
user = retrieveUser(username,
(UsernamePasswordAuthenticationToken) authentication);
preAuthenticationChecks.check(user);
additionalAuthenticationChecks(user,
(UsernamePasswordAuthenticationToken) authentication);
}
else {
throw exception;
}
}
// 检查凭据是否未过期
postAuthenticationChecks.check(user);
// 将查询到到的用户放入缓存中
if (!cacheWasUsed) {
this.userCache.putUserInCache(user);
}
Object principalToReturn = user;
if (forcePrincipalAsString) {
principalToReturn = user.getUsername();
}
// 创建Authentication[身份认证信息]
return createSuccessAuthentication(principalToReturn, authentication, user);
}
}
到这儿认证流程就结束了，但是我们可以继续往下看一下，底层如何根据username获取客户端用户信息的。
第四步
retrieveUser(username, (UsernamePasswordAuthenticationToken) authentication); 获取用户信息会调用DaoAuthenticationProvider#retrieveUser方法，该方法中，会调用UserDetailsService接口实现类的loadUserByUsername方法根据clientId获取客户端详情信息，代码如下：
public class DaoAuthenticationProvider extends AbstractUserDetailsAuthenticationProvider {
protected final UserDetails retrieveUser(String username,
UsernamePasswordAuthenticationToken authentication) throws AuthenticationException {
prepareTimingAttackProtection();
try {
// 调用UserDetailsService接口实现类的loadUserByUsername方法根据username获取用户信息
UserDetails loadedUser = this.getUserDetailsService().loadUserByUsername(username);
if (loadedUser == null) {
throw new InternalAuthenticationServiceException(
"UserDetailsService returned null, which is an interface contract violation");
}
return loadedUser;
}
catch (UsernameNotFoundException ex) {
mitigateAgainstTimingAttack(authentication);
throw ex;
}
catch (InternalAuthenticationServiceException ex) {
throw ex;
}
catch (Exception ex) {
throw new InternalAuthenticationServiceException(ex.getMessage(), ex);
}
}
protected UserDetailsService getUserDetailsService() {
return userDetailsService;
}
}
public interface UserDetailsService {
UserDetails loadUserByUsername(String username) throws UsernameNotFoundException;
}
第五步
UserDetails loadedUser = this.getUserDetailsService().loadUserByUsername(username); 会调用ClientDetailsUserDetailsService#loadUserByUsername方法，获取客户端详情信息：
@Deprecated
public class ClientDetailsUserDetailsService implements UserDetailsService {
private final ClientDetailsService clientDetailsService;
private String emptyPassword = "";
public ClientDetailsUserDetailsService(ClientDetailsService clientDetailsService) {
this.clientDetailsService = clientDetailsService;
}
public void setPasswordEncoder(PasswordEncoder passwordEncoder) {
this.emptyPassword = passwordEncoder.encode("");
}
public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
ClientDetails clientDetails;
try {
// 虎获取客户端详情
clientDetails = this.clientDetailsService.loadClientByClientId(username);
} catch (NoSuchClientException var4) {
throw new UsernameNotFoundException(var4.getMessage(), var4);
}
String clientSecret = clientDetails.getClientSecret();
if (clientSecret == null || clientSecret.trim().length() == 0) {
clientSecret = this.emptyPassword;
}
// 将客户端信息 ClientDetails 封装成UserDetails并返回
return new User(username, clientSecret, clientDetails.getAuthorities());
}
}
第六步
在该方法中会调用ClientDetailsService接口实现类BaseClientDetails#loadClientByClientId方法获取ClientDetails信息：
@Deprecated
public interface ClientDetailsService {
ClientDetails loadClientByClientId(String var1) throws ClientRegistrationException;
}
public interface ClientDetails extends Serializable {
String getClientId();//客户端id
Set<String> getResourceIds();//此客户端可以访问的资源。如果为空，则调用者可以忽略
boolean isSecretRequired();//验证此客户端是否需要secret
String getClientSecret();//获取客户端的secret
boolean isScoped();//此客户端是否仅限于特定范围
Set<String> getScope();//此客户端的范围。如果客户端未确定作用域，则为空
Set<String> getAuthorizedGrantTypes();//此客户端被授权的授权类型
Set<String> getRegisteredRedirectUri();//此客户端的预定义重定向redirect_url
Collection<GrantedAuthority> getAuthorities();//权限集合
Integer getAccessTokenValiditySeconds();//访问令牌有效期
Integer getRefreshTokenValiditySeconds();//刷新令牌有效期
boolean isAutoApprove(String scope);//测试客户端是否需要特定范围的用户批准
Map<String, Object> getAdditionalInformation();//额外的信息
}
BaseClientDetails [
clientId=ngsoc,
clientSecret={
bcrypt}$2a$10$Dcn01QtYjhoXeeX0LPsn/.DBiiosgsFFKHVC1/tQiWk5dht1TgtKy,
scope=[],
resourceIds=[],
authorizedGrantTypes=[password, refresh_token, client_credentials],
registeredRedirectUris=[],
authorities=[],
accessTokenValiditySeconds=43200,
refreshTokenValiditySeconds=86400,
additionalInformation={
}
]