// DefaultLoginPageGeneratingFilter
	@Override
	public void doFilter(ServletRequest request,
	 ServletResponse response, 
	FilterChain chain)
			throws IOException, ServletException {
		doFilter((HttpServletRequest) request, (HttpServletResponse) response, chain);
	}
    private void doFilter(HttpServletRequest request, 
    HttpServletResponse response, 
    FilterChain chain) throws IOException, ServletException {
        boolean loginError = this.isErrorPage(request);
        boolean logoutSuccess = this.isLogoutSuccess(request);
        // 判斷是否是登錄請求、登錄錯誤和注銷確認
        // 不是的話給用戶返回登錄界面
        if (!this.isLoginUrlRequest(request) && !loginError && !logoutSuccess) {
            chain.doFilter(request, response);
        } else {
        // generateLoginPageHtml方法中有對頁面登錄代碼進行了字符串拼接
        // 太長了，這里就不給出來了
            String loginPageHtml = this.generateLoginPageHtml(request, loginError, logoutSuccess);
            response.setContentType("text/html;charset=UTF-8");
            response.setContentLength(loginPageHtml.getBytes(StandardCharsets.UTF_8).length);
            response.getWriter().write(loginPageHtml);
        }
    }

@Override
	public Authentication attemptAuthentication(HttpServletRequest request, 
	HttpServletResponse response)
			throws AuthenticationException {
			// 首先是判斷是否是POST請求
		if (this.postOnly && !request.getMethod().equals("POST")) {
			throw new AuthenticationServiceException("Authentication method not supported: " + request.getMethod());
		}
		// 獲取用戶名和密碼
		// 這是通過獲取表單輸入框名為username的數(shù)據(jù)
		String username = obtainUsername(request);
		username = (username != null) ? username.trim() : "";
		// 這是獲取表單輸入框名為password的數(shù)據(jù)
		String password = obtainPassword(request);
		password = (password != null) ? password : "";
		UsernamePasswordAuthenticationToken authRequest = UsernamePasswordAuthenticationToken.unauthenticated(username,
				password);
		// Allow subclasses to set the "details" property
		setDetails(request, authRequest);
		// 在一中小編也說了，這是Security中的認證
		// 通過調(diào)用AuthenticationManager中的authenticate方法
		// 需要傳遞的參數(shù)的Authentication對象，當(dāng)時是這樣解釋的
		return this.getAuthenticationManager()
		.authenticate(authRequest);
	}

AbstractUserDetailsAuthenticationProvider下的authenticate方法
	@Override
	public Authentication authenticate(Authentication authentication) 
	throws AuthenticationException {
// 斷言 authentication 是否是UsernamePasswordAuthenticationToken對象
	Assert.isInstanceOf(UsernamePasswordAuthenticationToken.class, authentication,
				() -> this.messages.getMessage("AbstractUserDetailsAuthenticationProvider.onlySupports",
						"Only UsernamePasswordAuthenticationToken is supported"));
		// 獲取一下用戶名
		String username = determineUsername(authentication);
		boolean cacheWasUsed = true;
		// 從緩存中拿UserDetails 對象，顯然沒有，咱剛調(diào)試呢，哪來的緩存
		UserDetails user = this.userCache.getUserFromCache(username);
		if (user == null) {
		// 既然為空呢，就說明這不是從緩存中拿的，調(diào)為false
			cacheWasUsed = false;
			try {
			// 核心代碼，獲取UserDetails對象去
				user = retrieveUser(username, (UsernamePasswordAuthenticationToken) authentication);
			}
			catch (UsernameNotFoundException ex) {
				this.logger.debug("Failed to find user '" + username + "'");
				if (!this.hideUserNotFoundExceptions) {
					throw ex;
				}
				throw new BadCredentialsException(this.messages
						.getMessage("AbstractUserDetailsAuthenticationProvider.badCredentials", "Bad credentials"));
			}
			Assert.notNull(user, "retrieveUser returned null - a violation of the interface contract");
		}
		try {
			this.preAuthenticationChecks.check(user);
			// 這里是驗證密碼的，通過子類DaoAuthenticationProvider的這個方法對密碼去進行驗證
			// 傳過去的參數(shù)是user（UserDetails對象）和authentication對象
			additionalAuthenticationChecks(user, (UsernamePasswordAuthenticationToken) authentication);
		}
		catch (AuthenticationException ex) {
			if (!cacheWasUsed) {
				throw ex;
			}
			// There was a problem, so try again after checking
			// we're using latest data (i.e. not from the cache)
			cacheWasUsed = false;
			user = retrieveUser(username, (UsernamePasswordAuthenticationToken) authentication);
			this.preAuthenticationChecks.check(user);
			additionalAuthenticationChecks(user, (UsernamePasswordAuthenticationToken) authentication);
		}
		this.postAuthenticationChecks.check(user);
		if (!cacheWasUsed) {
			this.userCache.putUserInCache(user);
		}
		Object principalToReturn = user;
		if (this.forcePrincipalAsString) {
			principalToReturn = user.getUsername();
		}
		return createSuccessAuthentication(principalToReturn, authentication, user);
	}

// 一共兩個參數(shù)，一個是用戶名，一個是傳過來的認證信息
	@Override
	protected final UserDetails retrieveUser(String username, 
	UsernamePasswordAuthenticationToken authentication)
			throws AuthenticationException {
		prepareTimingAttackProtection();
		try {
		// 核心方法就是這個，通過UserDetatilsService中的loadUserByUsername方法去獲取UserDetails對象
			UserDetails loadedUser = this.getUserDetailsService().loadUserByUsername(username);
			if (loadedUser == null) {
				throw new InternalAuthenticationServiceException(
						"UserDetailsService returned null, which is an interface contract violation");
			}
			return loadedUser;
		}
		catch (UsernameNotFoundException ex) {
			mitigateAgainstTimingAttack(authentication);
			throw ex;
		}
		catch (InternalAuthenticationServiceException ex) {
			throw ex;
		}
		catch (Exception ex) {
			throw new InternalAuthenticationServiceException(ex.getMessage(), ex);
		}
	}

@AutoConfiguration
@ConditionalOnClass(AuthenticationManager.class)
@ConditionalOnBean(ObjectPostProcessor.class)
@ConditionalOnMissingBean(
		value = { AuthenticationManager.class, AuthenticationProvider.class, UserDetailsService.class,
				AuthenticationManagerResolver.class },
		type = { "org.springframework.security.oauth2.jwt.JwtDecoder",
				"org.springframework.security.oauth2.server.resource.introspection.OpaqueTokenIntrospector",
				"org.springframework.security.oauth2.client.registration.ClientRegistrationRepository",
				"org.springframework.security.saml2.provider.service.registration.RelyingPartyRegistrationRepository" })
public class UserDetailsServiceAutoConfiguration {
	@Bean
	@Lazy
	public InMemoryUserDetailsManager inMemoryUserDetailsManager(SecurityProperties properties,
			ObjectProvider<PasswordEncoder> passwordEncoder) {
			// 這里是從SecurityProperties中獲取User對象（這里的User對象是SecurityProperties的靜態(tài)內(nèi)部類）
		SecurityProperties.User user = properties.getUser();
		List<String> roles = user.getRoles();
		// 然后創(chuàng)建InMemoryUserDetailsManager對象返回
		// 交給Spring容器管理
		return new InMemoryUserDetailsManager(User.withUsername(user.getName())
			.password(getOrDeducePassword(user, passwordEncoder.getIfAvailable()))
			.roles(StringUtils.toStringArray(roles))
			.build());
	}
	}

# application.yml
spring:
  security:
    user:
      name: xxx
      password: 123