/**
UsernamePasswordAuthenticationFilter：處理身份驗(yàn)證表單提交
以及將請(qǐng)求信息封裝為Authentication 然后返回給上層父類，
父類再通過 SecurityContextHolder.getContext().setAuthentication(authResult); 將驗(yàn)證過的Authentication 保存至安全上下文中
 */
public class UsernamePasswordAuthenticationFilter extends AbstractAuthenticationProcessingFilter {

	public static final String SPRING_SECURITY_FORM_USERNAME_KEY = "username";

	public static final String SPRING_SECURITY_FORM_PASSWORD_KEY = "password";

	private static final AntPathRequestMatcher DEFAULT_ANT_PATH_REQUEST_MATCHER = new AntPathRequestMatcher("/login",
			"POST");

    //可以通過對(duì)應(yīng)的set方法修改
	private String usernameParameter = SPRING_SECURITY_FORM_USERNAME_KEY;
	private String passwordParameter = SPRING_SECURITY_FORM_PASSWORD_KEY;

	private boolean postOnly = true;

       //  初始化一個(gè)用戶密碼 認(rèn)證過濾器  默認(rèn)的登錄uri 是 /login 請(qǐng)求方式是POST
	public UsernamePasswordAuthenticationFilter() {
		super(DEFAULT_ANT_PATH_REQUEST_MATCHER);
	}

	public UsernamePasswordAuthenticationFilter(AuthenticationManager authenticationManager) {
		super(DEFAULT_ANT_PATH_REQUEST_MATCHER, authenticationManager);
	}

	@Override
	public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response)
			throws AuthenticationException {
		if (this.postOnly && !request.getMethod().equals("POST")) {
			throw new AuthenticationServiceException("Authentication method not supported: " + request.getMethod());
		}
		String username = obtainUsername(request);
		username = (username != null) ? username : "";
		username = username.trim();
		String password = obtainPassword(request);
		password = (password != null) ? password : "";
       	//把賬號(hào)名、密碼封裝到一個(gè)認(rèn)證Token對(duì)象中，這是一個(gè)通行證，但是此時(shí)的狀態(tài)時(shí)不可信的，通過認(rèn)證后才會(huì)變?yōu)榭尚诺?
		UsernamePasswordAuthenticationToken authRequest = new UsernamePasswordAuthenticationToken(username, password);
		// Allow subclasses to set the "details" property
        //記錄遠(yuǎn)程地址，如果會(huì)話已經(jīng)存在（它不會(huì)創(chuàng)建），還將設(shè)置會(huì)話 ID
		setDetails(request, authRequest);
        //使用 父類中的 AuthenticationManager 對(duì)Token 進(jìn)行認(rèn)證 
		return this.getAuthenticationManager().authenticate(authRequest);
	}

	/**
		obtainUsername和obtainPassword就是方便從request中獲取到username和password
		實(shí)際上如果在前后端分離的項(xiàng)目中 我們大都用不上??  因?yàn)榍岸藗鬟^來的是JSON數(shù)據(jù)，我們通常是使用JSON工具類進(jìn)行解析
	 */
	@Nullable
	protected String obtainPassword(HttpServletRequest request) {
		return request.getParameter(this.passwordParameter);
	}
	@Nullable
	protected String obtainUsername(HttpServletRequest request) {
		return request.getParameter(this.usernameParameter);
	}

	/**
		提供以便子類可以配置放入身份驗(yàn)證請(qǐng)求的詳細(xì)信息
	 */
	protected void setDetails(HttpServletRequest request, UsernamePasswordAuthenticationToken authRequest) {
		authRequest.setDetails(this.authenticationDetailsSource.buildDetails(request));
	}
	
    /**
	...省略一些不重要的代碼 set get
	*/
}

public class UsernamePasswordAuthenticationToken extends AbstractAuthenticationToken {

	private static final long serialVersionUID = SpringSecurityCoreVersion.SERIAL_VERSION_UID;

    // 這里就是用戶名和密碼 自定義時(shí) 根據(jù)自己需求進(jìn)行重寫
	private final Object principal;
	private Object credentials;

	/**
//把賬號(hào)名、密碼封裝到一個(gè)認(rèn)證UsernamePasswordAuthenticationToken對(duì)象中，這是一個(gè)通行證，但是此時(shí)的狀態(tài)時(shí)不可信的，
//我們?cè)谶@也可以看到 權(quán)限是null， setAuthenticated(false);是表示此刻身份是未驗(yàn)證的 所以此時(shí)狀態(tài)是不可信的
	 */
	public UsernamePasswordAuthenticationToken(Object principal, Object credentials) {
		super(null);
		this.principal = principal;
		this.credentials = credentials;
		setAuthenticated(false);
	}

	/**	這個(gè)時(shí)候才是可信的狀態(tài) */
	public UsernamePasswordAuthenticationToken(Object principal, Object credentials,
			Collection<? extends GrantedAuthority> authorities) {
		super(authorities);
		this.principal = principal;
		this.credentials = credentials;
		super.setAuthenticated(true); // must use super, as we override
	}
	// ...
}

//我們可以看到 AuthenticationManager 實(shí)際上就是一個(gè)接口，所以它并不做真正的事情，只是提供了一個(gè)標(biāo)準(zhǔn)，我們就繼續(xù)去看看它的實(shí)現(xiàn)類，看看是誰幫它做了事。
public interface AuthenticationManager {
    //嘗試對(duì)傳遞的Authentication對(duì)象進(jìn)行身份Authentication ，如果成功則返回完全填充的Authentication對(duì)象（包括授予的權(quán)限）。
	Authentication authenticate(Authentication authentication) throws AuthenticationException;
}

public class ProviderManager implements AuthenticationManager, MessageSourceAware, InitializingBean {

    //省略了一些代碼
    private List<AuthenticationProvider> providers = Collections.emptyList();
    
	/**
	 * 嘗試對(duì)傳遞的Authentication對(duì)象進(jìn)行身份Authentication 。AuthenticationProvider的列表將被連續(xù)嘗試，
	 * 直到AuthenticationProvider表明它能夠驗(yàn)證所傳遞的Authentication對(duì)象的類型。 然后將嘗試使用該AuthenticationProvider 。
	 */
	@Override
	public Authentication authenticate(Authentication authentication) throws AuthenticationException {
		Class<? extends Authentication> toTest = authentication.getClass();
		Authentication result = null;
		Authentication parentResult = null;
		int currentPosition = 0;
		int size = this.providers.size();
 
        //我們遍歷AuthenticationProvider 列表中每個(gè)Provider依次進(jìn)行認(rèn)證
       // 不過你會(huì)發(fā)現(xiàn) AuthenticationProvider 也是一個(gè)接口，它的實(shí)現(xiàn)類才是真正做事的人 ,下文有
		for (AuthenticationProvider provider : getProviders()) {
			if (!provider.supports(toTest)) {
				continue;
			}
			//...
			try {
                //provider.authenticate()
                //參數(shù)：身份驗(yàn)證 - 身份驗(yàn)證請(qǐng)求對(duì)象。
                //返回：一個(gè)完全經(jīng)過身份驗(yàn)證的對(duì)象，包括憑據(jù)。 如果AuthenticationProvider無法支持對(duì)傳遞的Authentication對(duì)象進(jìn)行身份驗(yàn)證，則可能返回null  ,我們接著看它的實(shí)現(xiàn)類是什么樣子的
				result = provider.authenticate(authentication);
				if (result != null) {
					copyDetails(authentication, result);
					break;
				}
			}
			catch (AccountStatusException | InternalAuthenticationServiceException ex) {
			//....
			}
		}
        // 如果 AuthenticationProvider 列表中的Provider都認(rèn)證失敗，且之前有構(gòu)造一個(gè) AuthenticationManager 實(shí)現(xiàn)類，那么利用AuthenticationManager 實(shí)現(xiàn)類 繼續(xù)認(rèn)證
		if (result == null && this.parent != null) {
			// Allow the parent to try.
			try {
				parentResult = this.parent.authenticate(authentication);
				result = parentResult;
			}
			catch (ProviderNotFoundException ex) {
			// ...
			}
		}
         //認(rèn)證成功
		if (result != null) {
			if (eraseCredentialsAfterAuthentication
					&& (result instanceof CredentialsContainer)) {
				// Authentication is complete. Remove credentials and other secret data
				// from authentication
				//成功認(rèn)證后刪除驗(yàn)證信息
				((CredentialsContainer) result).eraseCredentials();
			}
            //發(fā)布登錄成功事件
			eventPublisher.publishAuthenticationSuccess(result);
			return result;
		}
		// 沒有認(rèn)證成功，拋出異常
		if (lastException == null) {
			lastException = new ProviderNotFoundException(messages.getMessage(
					"ProviderManager.providerNotFound",
					new Object[] { toTest.getName() },
					"No AuthenticationProvider found for {0}"));
		}
		prepareException(lastException, authentication);
		throw lastException;
	}
}

public interface AuthenticationProvider {

	/**
	認(rèn)證方法
	參數(shù)：身份驗(yàn)證 - 身份驗(yàn)證請(qǐng)求對(duì)象。
	返回：一個(gè)完全經(jīng)過身份驗(yàn)證的對(duì)象，包括憑據(jù)。
	 */
	Authentication authenticate(Authentication authentication) throws AuthenticationException;

	/**
		該P(yáng)rovider是否支持對(duì)應(yīng)的Authentication
		如果此AuthenticationProvider支持指定的Authentication對(duì)象，則返回true 。	
	 */
	boolean supports(Class<?> authentication);

}

/**
一個(gè)基本的AuthenticationProvider ，它允許子類覆蓋和使用UserDetails對(duì)象。 該類旨在響應(yīng)UsernamePasswordAuthenticationToken身份驗(yàn)證請(qǐng)求。
驗(yàn)證成功后，將創(chuàng)建UsernamePasswordAuthenticationToken并將其返回給調(diào)用者。 令牌將包括用戶名的String表示或從身份驗(yàn)證存儲(chǔ)庫返回的UserDetails作為其主體。
 */
public abstract class AbstractUserDetailsAuthenticationProvider
		implements AuthenticationProvider, InitializingBean, MessageSourceAware {

    //...省略了一些代碼
	private UserCache userCache = new NullUserCache();

	private GrantedAuthoritiesMapper authoritiesMapper = new NullAuthoritiesMapper();

    
	//認(rèn)證方法
	@Override
	public Authentication authenticate(Authentication authentication) throws AuthenticationException {
		Assert.isInstanceOf(UsernamePasswordAuthenticationToken.class, authentication,
				() -> this.messages.getMessage("AbstractUserDetailsAuthenticationProvider.onlySupports",
						"Only UsernamePasswordAuthenticationToken is supported"));
        //判斷用戶名是否為空
		String username = determineUsername(authentication);
		boolean cacheWasUsed = true;
        //先查緩存
		UserDetails user = this.userCache.getUserFromCache(username);
		if (user == null) {
			cacheWasUsed = false;
			try {
				user = retrieveUser(username, (UsernamePasswordAuthenticationToken) authentication);
			}
			catch (UsernameNotFoundException ex) {
				this.logger.debug("Failed to find user '" + username + "'");
				if (!this.hideUserNotFoundExceptions) {
					throw ex;
				}
				throw new BadCredentialsException(this.messages
						.getMessage("AbstractUserDetailsAuthenticationProvider.badCredentials", "Bad credentials"));
			}
			Assert.notNull(user, "retrieveUser returned null - a violation of the interface contract");
		}
		try {
            //一些檢查
			this.preAuthenticationChecks.check(user);
			additionalAuthenticationChecks(user, (UsernamePasswordAuthenticationToken) authentication);
		}
		catch (AuthenticationException ex) {
			if (!cacheWasUsed) {
				throw ex;
			}
			// There was a problem, so try again after checking
			// we're using latest data (i.e. not from the cache)
			cacheWasUsed = false;
            //retrieveUser 是個(gè)沒有抽象的方法 稍后我們看看它的實(shí)現(xiàn)類是如何實(shí)現(xiàn)的
			user = retrieveUser(username, (UsernamePasswordAuthenticationToken) authentication);
            //一些檢查信息 用戶是否可用什么的
			this.preAuthenticationChecks.check(user);
			additionalAuthenticationChecks(user, (UsernamePasswordAuthenticationToken) authentication);
		}
		this.postAuthenticationChecks.check(user);
		if (!cacheWasUsed) {
			this.userCache.putUserInCache(user);
		}
		Object principalToReturn = user;
		if (this.forcePrincipalAsString) {
			principalToReturn = user.getUsername();
		}
        //創(chuàng)建一個(gè)成功的Authentication對(duì)象。
		return createSuccessAuthentication(principalToReturn, authentication, user);
	}

	private String determineUsername(Authentication authentication) {
		return (authentication.getPrincipal() == null) ? "NONE_PROVIDED" : authentication.getName();
	}

	/**
		創(chuàng)建一個(gè)成功的Authentication對(duì)象。 這個(gè)也允許字類進(jìn)行實(shí)現(xiàn)。
		如果要給密碼加密的話，一般字類都會(huì)重新進(jìn)行實(shí)現(xiàn)
	 */
	protected Authentication createSuccessAuthentication(Object principal, Authentication authentication,
			UserDetails user) {
		//身份信息在這里也加入進(jìn)去了
		UsernamePasswordAuthenticationToken result = new UsernamePasswordAuthenticationToken(principal,
				authentication.getCredentials(), this.authoritiesMapper.mapAuthorities(user.getAuthorities()));
		result.setDetails(authentication.getDetails());
		this.logger.debug("Authenticated user");
		return result;
	}



	/**
允許子類從特定于實(shí)現(xiàn)的位置實(shí)際檢索UserDetails ，如果提供的憑據(jù)不正確，則可以選擇立即拋出AuthenticationException （如果需要以用戶身份綁定到資源以獲得或生成一個(gè)UserDetails ）
	 */
	protected abstract UserDetails retrieveUser(String username, UsernamePasswordAuthenticationToken authentication)
			throws AuthenticationException;

    //...
}

/**
從UserDetailsService檢索用戶詳細(xì)信息的AuthenticationProvider實(shí)現(xiàn)。
 */
public class DaoAuthenticationProvider extends AbstractUserDetailsAuthenticationProvider {

    // ...省略了一些代碼
    
	/** */
	@Override
	protected final UserDetails retrieveUser(String username, UsernamePasswordAuthenticationToken authentication)
			throws AuthenticationException {
		prepareTimingAttackProtection();
		try {
            //UserDetailsService簡(jiǎn)單說就是加載對(duì)應(yīng)的UserDetails的接口(一般從數(shù)據(jù)庫)，而UserDetails包含了更詳細(xì)的用戶信息
            //通過loadUserByUsername獲取用戶信息 ，返回一個(gè) UserDetails 
			UserDetails loadedUser = this.getUserDetailsService().loadUserByUsername(username);
			if (loadedUser == null) {
				throw new InternalAuthenticationServiceException(
						"UserDetailsService returned null, which is an interface contract violation");
			}
			return loadedUser;
		}
		catch (UsernameNotFoundException ex) {
			mitigateAgainstTimingAttack(authentication);
			throw ex;
		}
		catch (InternalAuthenticationServiceException ex) {
			throw ex;
		}
		catch (Exception ex) {
			throw new InternalAuthenticationServiceException(ex.getMessage(), ex);
		}   
	}
   	// 重新父類的方法，對(duì)密碼進(jìn)行一些加密操作
    @Override
    protected Authentication createSuccessAuthentication(Object principal, Authentication authentication,
                                                         UserDetails user) {
        boolean upgradeEncoding = this.userDetailsPasswordService != null
            && this.passwordEncoder.upgradeEncoding(user.getPassword());
        if (upgradeEncoding) {
            String presentedPassword = authentication.getCredentials().toString();
            String newPassword = this.passwordEncoder.encode(presentedPassword);
            user = this.userDetailsPasswordService.updatePassword(user, newPassword);
        }
        return super.createSuccessAuthentication(principal, authentication, user);
    }

	//...
}

//加載用戶特定數(shù)據(jù)的核心接口。
public interface UserDetailsService {
		//根據(jù)用戶名定位用戶
	UserDetails loadUserByUsername(String username) throws UsernameNotFoundException;
}

/**
提供核心用戶信息。
出于安全目的，Spring Security 不直接使用實(shí)現(xiàn)。 它們只是存儲(chǔ)用戶信息，然后將這些信息封裝到Authentication對(duì)象中。 這允許將非安全相關(guān)的用戶信息（例如電子郵件地址、電話號(hào)碼等）存儲(chǔ)在方便的位置。
 */
public interface UserDetails extends Serializable {
	//返回授予用戶的權(quán)限。 
	Collection<? extends GrantedAuthority> getAuthorities();
	String getPassword();
	String getUsername();

	//指示用戶的帳戶是否已過期。 無法驗(yàn)證過期帳戶
	boolean isAccountNonExpired();

	//指示用戶是被鎖定還是未鎖定。 無法對(duì)鎖定的用戶進(jìn)行身份驗(yàn)證。
	boolean isAccountNonLocked();

	//指示用戶的憑據(jù)（密碼）是否已過期。 過期的憑據(jù)會(huì)阻止身份驗(yàn)證。
	boolean isCredentialsNonExpired();

	//指示用戶是啟用還是禁用。 無法對(duì)禁用的用戶進(jìn)行身份驗(yàn)證。
	boolean isEnabled();
}

protected Authentication createSuccessAuthentication(Object principal, Authentication authentication,
                                                     UserDetails user) {
    UsernamePasswordAuthenticationToken result = new UsernamePasswordAuthenticationToken(principal,
                                                                                         authentication.getCredentials(), this.authoritiesMapper.mapAuthorities(user.getAuthorities()));
    result.setDetails(authentication.getDetails());
    this.logger.debug("Authenticated user");
    return result;
}

public abstract class AbstractAuthenticationProcessingFilter extends GenericFilterBean
    implements ApplicationEventPublisherAware, MessageSourceAware {
    @Override
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
        throws IOException, ServletException {
        doFilter((HttpServletRequest) request, (HttpServletResponse) response, chain);
    }

    private void doFilter(HttpServletRequest request, HttpServletResponse response, FilterChain chain)
        throws IOException, ServletException {
        if (!requiresAuthentication(request, response)) {
            chain.doFilter(request, response);
            return;
        }
        try {
            // 這里就是調(diào)用處。
            Authentication authenticationResult = attemptAuthentication(request, response);
            if (authenticationResult == null) {
                // return immediately as subclass has indicated that it hasn't completed
                return;
            }
            // session相關(guān)，這里我們不深聊
            //發(fā)生新的身份驗(yàn)證時(shí)執(zhí)行與 Http 會(huì)話相關(guān)的功能。
            this.sessionStrategy.onAuthentication(authenticationResult, request, response);
            // Authentication success
            if (this.continueChainBeforeSuccessfulAuthentication) {
                chain.doFilter(request, response);
            }
            //看方法名我們就知道 這是我們需要的拉
            //成功驗(yàn)證省份后調(diào)用
            successfulAuthentication(request, response, chain, authenticationResult);
        }
        catch (InternalAuthenticationServiceException failed) {
            this.logger.error("An internal error occurred while trying to authenticate the user.", failed);
            //驗(yàn)證失敗調(diào)用
            unsuccessfulAuthentication(request, response, failed);
        }
        catch (AuthenticationException ex) {
            // Authentication failed
            //驗(yàn)證失敗調(diào)用
            unsuccessfulAuthentication(request, response, ex);
        }
    }
}

//成功身份驗(yàn)證的默認(rèn)行為。
	//1、在SecurityContextHolder上設(shè)置成功的Authentication對(duì)象
	//2、通知配置的RememberMeServices登錄成功
	//3、通過配置的ApplicationEventPublisher觸發(fā)InteractiveAuthenticationSuccessEvent
	//4、將附加行為委托給AuthenticationSuccessHandler 。
//子類可以覆蓋此方法以在身份驗(yàn)證成功后繼續(xù)FilterChain 。
protected void successfulAuthentication(HttpServletRequest request, HttpServletResponse response, FilterChain chain,
                                        Authentication authResult) throws IOException, ServletException {
    //將通過驗(yàn)證的Authentication保存至安全上下文
    SecurityContextHolder.getContext().setAuthentication(authResult);
    if (this.logger.isDebugEnabled()) {
        this.logger.debug(LogMessage.format("Set SecurityContextHolder to %s", authResult));
    }
    this.rememberMeServices.loginSuccess(request, response, authResult);
    if (this.eventPublisher != null) {
        this.eventPublisher.publishEvent(new InteractiveAuthenticationSuccessEvent(authResult, this.getClass()));
    }
    this.successHandler.onAuthenticationSuccess(request, response, authResult);
}