acegi源码学习之用户登录篇

一、查看 applicationContext-acegi-security.xml 配置文件，涉及到登录的配置为：

 1 ．

< bean id = "authenticationProcessingFilter" class = "org.javajohn.test.plugins.security.UserAuthenticationProcessingFilter" >

        < property name = "authenticationManager" ref = "authenticationManager" />

        < property name = "authenticationFailureUrl" >

            < value > /login.jsp?login_error=1 </ value >

        </ property >

        < property name = "defaultTargetUrl" >

            < value > /index.jsp </ value >

        </ property >

        < property name = "filterProcessesUrl" >

            < value > /j_acegi_security_check </ value >

        </ property >

        < property name = "userManager" ref = "userManager" />

        < property name = "rememberMeServices" ref = "rememberMeServices" />

        < property name = "exceptionMappings" >

            < value >

                org.acegisecurity.AuthenticationException=/login.jsp?login_error=user_psw_error

                org.acegisecurity.concurrent.ConcurrentLoginException=/login.jsp?login_error=too_many_user_error

             </ value >

        </ property >

</ bean >

 

 

2 ． < bean id = "authenticationManager"

       class = "org.acegisecurity.providers.ProviderManager" >

       < property name = "providers" >

           < list >

              < ref local = "daoAuthenticationProvider" />

              < bean class = "org.acegisecurity.providers.anonymous.AnonymousAuthenticationProvider" >

                  < property name = "key" value = "javajohnKey" />

              </ bean >

              < bean class = "org.acegisecurity.providers.rememberme.RememberMeAuthenticationProvider" >

                  < property name = "key" value = "javajohnKey" />

              </ bean >

           </ list >

       </ property >   

    </ bean >

 

3 ．

< bean id = "daoAuthenticationProvider" class = "org.acegisecurity.providers.dao.DaoAuthenticationProvider" >

       < property name = "userDetailsService" ref = "jdbcDaoImpl" />

       < property name = "userCache" >

           < bean class = "org.acegisecurity.providers.dao.cache.EhCacheBasedUserCache" >

              < property name = "cache" >

                  < bean class = "org.springframework.cache.ehcache.EhCacheFactoryBean" >

                     < property name = "cacheManager" >

                         < bean class = "org.springframework.cache.ehcache.EhCacheManagerFactoryBean" />

                     </ property >

                     < property name = "cacheName" value = "userCache" />

                  </ bean >

              </ property >

           </ bean >

       </ property >

       < property name = "passwordEncoder" ref = "passwordEncoder" />

    </ bean >

 

 

4 ． < bean id = "jdbcDaoImpl"

          class = "org.acegisecurity.userdetails.jdbc.JdbcDaoImpl" >

        < property name = "dataSource" ref = "dataSource" />

        < property name = "usersByUsernameQuery" >

            < value >

                select loginid,passwd,1 from users where status=‘1‘ and loginid = ?

            </ value >

        </ property >

        < property name = "authoritiesByUsernameQuery" >

            < value >

                select u.loginid,p.name from

                users u,roles r,permissions p,user_role ur,role_permis rp

                where

                u.id=ur.user_id and

                r.id=ur.role_id and

                p.id=rp.permis_id and

                r.id=rp.role_id and

                p.status=‘1‘ and u.loginid=?

            </ value >

        </ property >

</ bean >

 

 

二、程序流程：

1 ．登录的时候执行的过滤为 authenticationProcessingFilter ，查看其实现为 org.bookStore.test.plugins.security.UserAuthenticationProcessingFilter ，该类继承自 org.acegisecurity.ui.webapp.AuthenticationProcessingFilter ，又继承自 org.acegisecurity.ui.AbstractProcessingFilter ，这时候看到了 doFilter() 该方法取了 web 层传过来的 request 和 response ，然后对登录路径执行了判断等操作，接下来执行至 authResult = attemptAuthentication(httpRequest);

2 ．从类继承关系上找到该方法的实现来自 AuthenticationProcessingFilter ，执行的逻辑为先取出 web 层传过来的用户名和密码接着将得到的信息包装为 UsernamePasswordAuthenticationToken ：

public UsernamePasswordAuthenticationToken(Object principal, Object credentials) {

    super ( null );

    this . principal = principal;    

    this . credentials = credentials;

    setAuthenticated( false );

}

3 ．接下来执行了 setDetails(request, authRequest); 将 request 实例赋给 authRequest 的属性。

4 ．调用 authenticationManager 的 authenticate(authRequest) 方法。

5 ．程序转至 authenticationManager 内执行。该类继承自 org.acegisecurity. AbstractAuthenticationManager ，执行方法 authenticate(authRequest) ：

public final Authentication authenticate(Authentication authRequest)

    throws AuthenticationException {

    try {

        Authentication authResult = doAuthentication(authRequest);

        copyDetails(authRequest, authResult);

 

        return authResult;

    } catch (AuthenticationException e) {

        e.setAuthentication(authRequest);

        throw e;

    }

}

doAuthentication(authRequest) 来自 ProviderManager 该方法执行了其 providers 中的方法 authenticate(Authentication authentication)

6 ．此方法中调用了 retrieveUser(username, (UsernamePasswordAuthenticationToken) authentication) 该方法内按 web 层用户输入的用户名和密码从数据库内比较是否有该用户，如果有则将其 user 表内对应的信息包装为 UserDetail( 接口 , 实际为 User 的实例 ) 的 List 对象，并将该用户相应的权限包装为 GrantedAuthorityImpl 对象的 List 集合对象。至此程序返回至（ 3. ）继续执行

7 ．继续执行 org.acegisecurity.ui.AbstractProcessingFilter 的 successfulAuthentication(

HttpServletRequest request,

HttpServletResponse response,

Authentication authResult){

    ......

SecurityContextHolder.getContext().setAuthentication(authResult);// 将包装好的 UsernamePasswordAuthenticationToken 对象保存至系统上下文

......

}

8 ．登录执行完毕。