/**
UsernamePasswordAuthenticationFilter：處理身份驗證表單提交
以及將請求信息封裝為Authentication 然后返回給上層父類，
父類再通過 SecurityContextHolder.getContext().setAuthentication(authResult); 將驗證過的Authentication 保存至安全上下文中
 */
public class UsernamePasswordAuthenticationFilter extends AbstractAuthenticationProcessingFilter {

	public static final String SPRING_SECURITY_FORM_USERNAME_KEY = "username";

	public static final String SPRING_SECURITY_FORM_PASSWORD_KEY = "password";

	private static final AntPathRequestMatcher DEFAULT_ANT_PATH_REQUEST_MATCHER = new AntPathRequestMatcher("/login",
			"POST");

    //可以通過對應(yīng)的set方法修改
	private String usernameParameter = SPRING_SECURITY_FORM_USERNAME_KEY;
	private String passwordParameter = SPRING_SECURITY_FORM_PASSWORD_KEY;

	private boolean postOnly = true;

       //  初始化一個用戶密碼 認(rèn)證過濾器  默認(rèn)的登錄uri 是 /login 請求方式是POST
	public UsernamePasswordAuthenticationFilter() {
		super(DEFAULT_ANT_PATH_REQUEST_MATCHER);
	}

	public UsernamePasswordAuthenticationFilter(AuthenticationManager authenticationManager) {
		super(DEFAULT_ANT_PATH_REQUEST_MATCHER, authenticationManager);
	}

	@Override
	public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response)
			throws AuthenticationException {
		if (this.postOnly && !request.getMethod().equals("POST")) {
			throw new AuthenticationServiceException("Authentication method not supported: " + request.getMethod());
		}
		String username = obtainUsername(request);
		username = (username != null) ? username : "";
		username = username.trim();
		String password = obtainPassword(request);
		password = (password != null) ? password : "";
       	//把賬號名、密碼封裝到一個認(rèn)證Token對象中，這是一個通行證，但是此時的狀態(tài)時不可信的，通過認(rèn)證后才會變?yōu)榭尚诺?
		UsernamePasswordAuthenticationToken authRequest = new UsernamePasswordAuthenticationToken(username, password);
		// Allow subclasses to set the "details" property
        //記錄遠程地址，如果會話已經(jīng)存在（它不會創(chuàng)建），還將設(shè)置會話 ID
		setDetails(request, authRequest);
        //使用 父類中的 AuthenticationManager 對Token 進行認(rèn)證 
		return this.getAuthenticationManager().authenticate(authRequest);
	}

	/**
		obtainUsername和obtainPassword就是方便從request中獲取到username和password
		實際上如果在前后端分離的項目中 我們大都用不上??  因為前端傳過來的是JSON數(shù)據(jù)，我們通常是使用JSON工具類進行解析
	 */
	@Nullable
	protected String obtainPassword(HttpServletRequest request) {
		return request.getParameter(this.passwordParameter);
	}
	@Nullable
	protected String obtainUsername(HttpServletRequest request) {
		return request.getParameter(this.usernameParameter);
	}

	/**
		提供以便子類可以配置放入身份驗證請求的詳細(xì)信息
	 */
	protected void setDetails(HttpServletRequest request, UsernamePasswordAuthenticationToken authRequest) {
		authRequest.setDetails(this.authenticationDetailsSource.buildDetails(request));
	}
	
    /**
	...省略一些不重要的代碼 set get
	*/
}

public class UsernamePasswordAuthenticationToken extends AbstractAuthenticationToken {

	private static final long serialVersionUID = SpringSecurityCoreVersion.SERIAL_VERSION_UID;

    // 這里就是用戶名和密碼 自定義時 根據(jù)自己需求進行重寫
	private final Object principal;
	private Object credentials;

	/**
//把賬號名、密碼封裝到一個認(rèn)證UsernamePasswordAuthenticationToken對象中，這是一個通行證，但是此時的狀態(tài)時不可信的，
//我們在這也可以看到 權(quán)限是null， setAuthenticated(false);是表示此刻身份是未驗證的 所以此時狀態(tài)是不可信的
	 */
	public UsernamePasswordAuthenticationToken(Object principal, Object credentials) {
		super(null);
		this.principal = principal;
		this.credentials = credentials;
		setAuthenticated(false);
	}

	/**	這個時候才是可信的狀態(tài) */
	public UsernamePasswordAuthenticationToken(Object principal, Object credentials,
			Collection<? extends GrantedAuthority> authorities) {
		super(authorities);
		this.principal = principal;
		this.credentials = credentials;
		super.setAuthenticated(true); // must use super, as we override
	}
	// ...
}

//我們可以看到 AuthenticationManager 實際上就是一個接口，所以它并不做真正的事情，只是提供了一個標(biāo)準(zhǔn)，我們就繼續(xù)去看看它的實現(xiàn)類，看看是誰幫它做了事。
public interface AuthenticationManager {
    //嘗試對傳遞的Authentication對象進行身份Authentication ，如果成功則返回完全填充的Authentication對象（包括授予的權(quán)限）。
	Authentication authenticate(Authentication authentication) throws AuthenticationException;
}

public class ProviderManager implements AuthenticationManager, MessageSourceAware, InitializingBean {

    //省略了一些代碼
    private List<AuthenticationProvider> providers = Collections.emptyList();
    
	/**
	 * 嘗試對傳遞的Authentication對象進行身份Authentication 。AuthenticationProvider的列表將被連續(xù)嘗試，
	 * 直到AuthenticationProvider表明它能夠驗證所傳遞的Authentication對象的類型。 然后將嘗試使用該AuthenticationProvider 。
	 */
	@Override
	public Authentication authenticate(Authentication authentication) throws AuthenticationException {
		Class<? extends Authentication> toTest = authentication.getClass();
		Authentication result = null;
		Authentication parentResult = null;
		int currentPosition = 0;
		int size = this.providers.size();
 
        //我們遍歷AuthenticationProvider 列表中每個Provider依次進行認(rèn)證
       // 不過你會發(fā)現(xiàn) AuthenticationProvider 也是一個接口，它的實現(xiàn)類才是真正做事的人 ,下文有
		for (AuthenticationProvider provider : getProviders()) {
			if (!provider.supports(toTest)) {
				continue;
			}
			//...
			try {
                //provider.authenticate()
                //參數(shù)：身份驗證 - 身份驗證請求對象。
                //返回：一個完全經(jīng)過身份驗證的對象，包括憑據(jù)。 如果AuthenticationProvider無法支持對傳遞的Authentication對象進行身份驗證，則可能返回null  ,我們接著看它的實現(xiàn)類是什么樣子的
				result = provider.authenticate(authentication);
				if (result != null) {
					copyDetails(authentication, result);
					break;
				}
			}
			catch (AccountStatusException | InternalAuthenticationServiceException ex) {
			//....
			}
		}
        // 如果 AuthenticationProvider 列表中的Provider都認(rèn)證失敗，且之前有構(gòu)造一個 AuthenticationManager 實現(xiàn)類，那么利用AuthenticationManager 實現(xiàn)類 繼續(xù)認(rèn)證
		if (result == null && this.parent != null) {
			// Allow the parent to try.
			try {
				parentResult = this.parent.authenticate(authentication);
				result = parentResult;
			}
			catch (ProviderNotFoundException ex) {
			// ...
			}
		}
         //認(rèn)證成功
		if (result != null) {
			if (eraseCredentialsAfterAuthentication
					&& (result instanceof CredentialsContainer)) {
				// Authentication is complete. Remove credentials and other secret data
				// from authentication
				//成功認(rèn)證后刪除驗證信息
				((CredentialsContainer) result).eraseCredentials();
			}
            //發(fā)布登錄成功事件
			eventPublisher.publishAuthenticationSuccess(result);
			return result;
		}
		// 沒有認(rèn)證成功，拋出異常
		if (lastException == null) {
			lastException = new ProviderNotFoundException(messages.getMessage(
					"ProviderManager.providerNotFound",
					new Object[] { toTest.getName() },
					"No AuthenticationProvider found for {0}"));
		}
		prepareException(lastException, authentication);
		throw lastException;
	}
}

public interface AuthenticationProvider {

	/**
	認(rèn)證方法
	參數(shù)：身份驗證 - 身份驗證請求對象。
	返回：一個完全經(jīng)過身份驗證的對象，包括憑據(jù)。
	 */
	Authentication authenticate(Authentication authentication) throws AuthenticationException;

	/**
		該Provider是否支持對應(yīng)的Authentication
		如果此AuthenticationProvider支持指定的Authentication對象，則返回true 。	
	 */
	boolean supports(Class<?> authentication);

}

/**
一個基本的AuthenticationProvider ，它允許子類覆蓋和使用UserDetails對象。 該類旨在響應(yīng)UsernamePasswordAuthenticationToken身份驗證請求。
驗證成功后，將創(chuàng)建UsernamePasswordAuthenticationToken并將其返回給調(diào)用者。 令牌將包括用戶名的String表示或從身份驗證存儲庫返回的UserDetails作為其主體。
 */
public abstract class AbstractUserDetailsAuthenticationProvider
		implements AuthenticationProvider, InitializingBean, MessageSourceAware {

    //...省略了一些代碼
	private UserCache userCache = new NullUserCache();

	private GrantedAuthoritiesMapper authoritiesMapper = new NullAuthoritiesMapper();

    
	//認(rèn)證方法
	@Override
	public Authentication authenticate(Authentication authentication) throws AuthenticationException {
		Assert.isInstanceOf(UsernamePasswordAuthenticationToken.class, authentication,
				() -> this.messages.getMessage("AbstractUserDetailsAuthenticationProvider.onlySupports",
						"Only UsernamePasswordAuthenticationToken is supported"));
        //判斷用戶名是否為空
		String username = determineUsername(authentication);
		boolean cacheWasUsed = true;
        //先查緩存
		UserDetails user = this.userCache.getUserFromCache(username);
		if (user == null) {
			cacheWasUsed = false;
			try {
				user = retrieveUser(username, (UsernamePasswordAuthenticationToken) authentication);
			}
			catch (UsernameNotFoundException ex) {
				this.logger.debug("Failed to find user '" + username + "'");
				if (!this.hideUserNotFoundExceptions) {
					throw ex;
				}
				throw new BadCredentialsException(this.messages
						.getMessage("AbstractUserDetailsAuthenticationProvider.badCredentials", "Bad credentials"));
			}
			Assert.notNull(user, "retrieveUser returned null - a violation of the interface contract");
		}
		try {
            //一些檢查
			this.preAuthenticationChecks.check(user);
			additionalAuthenticationChecks(user, (UsernamePasswordAuthenticationToken) authentication);
		}
		catch (AuthenticationException ex) {
			if (!cacheWasUsed) {
				throw ex;
			}
			// There was a problem, so try again after checking
			// we're using latest data (i.e. not from the cache)
			cacheWasUsed = false;
            //retrieveUser 是個沒有抽象的方法 稍后我們看看它的實現(xiàn)類是如何實現(xiàn)的
			user = retrieveUser(username, (UsernamePasswordAuthenticationToken) authentication);
            //一些檢查信息 用戶是否可用什么的
			this.preAuthenticationChecks.check(user);
			additionalAuthenticationChecks(user, (UsernamePasswordAuthenticationToken) authentication);
		}
		this.postAuthenticationChecks.check(user);
		if (!cacheWasUsed) {
			this.userCache.putUserInCache(user);
		}
		Object principalToReturn = user;
		if (this.forcePrincipalAsString) {
			principalToReturn = user.getUsername();
		}
        //創(chuàng)建一個成功的Authentication對象。
		return createSuccessAuthentication(principalToReturn, authentication, user);
	}

	private String determineUsername(Authentication authentication) {
		return (authentication.getPrincipal() == null) ? "NONE_PROVIDED" : authentication.getName();
	}

	/**
		創(chuàng)建一個成功的Authentication對象。 這個也允許字類進行實現(xiàn)。
		如果要給密碼加密的話，一般字類都會重新進行實現(xiàn)
	 */
	protected Authentication createSuccessAuthentication(Object principal, Authentication authentication,
			UserDetails user) {
		//身份信息在這里也加入進去了
		UsernamePasswordAuthenticationToken result = new UsernamePasswordAuthenticationToken(principal,
				authentication.getCredentials(), this.authoritiesMapper.mapAuthorities(user.getAuthorities()));
		result.setDetails(authentication.getDetails());
		this.logger.debug("Authenticated user");
		return result;
	}



	/**
允許子類從特定于實現(xiàn)的位置實際檢索UserDetails ，如果提供的憑據(jù)不正確，則可以選擇立即拋出AuthenticationException （如果需要以用戶身份綁定到資源以獲得或生成一個UserDetails ）
	 */
	protected abstract UserDetails retrieveUser(String username, UsernamePasswordAuthenticationToken authentication)
			throws AuthenticationException;

    //...
}

/**
從UserDetailsService檢索用戶詳細(xì)信息的AuthenticationProvider實現(xiàn)。
 */
public class DaoAuthenticationProvider extends AbstractUserDetailsAuthenticationProvider {

    // ...省略了一些代碼
    
	/** */
	@Override
	protected final UserDetails retrieveUser(String username, UsernamePasswordAuthenticationToken authentication)
			throws AuthenticationException {
		prepareTimingAttackProtection();
		try {
            //UserDetailsService簡單說就是加載對應(yīng)的UserDetails的接口(一般從數(shù)據(jù)庫)，而UserDetails包含了更詳細(xì)的用戶信息
            //通過loadUserByUsername獲取用戶信息 ，返回一個 UserDetails 
			UserDetails loadedUser = this.getUserDetailsService().loadUserByUsername(username);
			if (loadedUser == null) {
				throw new InternalAuthenticationServiceException(
						"UserDetailsService returned null, which is an interface contract violation");
			}
			return loadedUser;
		}
		catch (UsernameNotFoundException ex) {
			mitigateAgainstTimingAttack(authentication);
			throw ex;
		}
		catch (InternalAuthenticationServiceException ex) {
			throw ex;
		}
		catch (Exception ex) {
			throw new InternalAuthenticationServiceException(ex.getMessage(), ex);
		}   
	}
   	// 重新父類的方法，對密碼進行一些加密操作
    @Override
    protected Authentication createSuccessAuthentication(Object principal, Authentication authentication,
                                                         UserDetails user) {
        boolean upgradeEncoding = this.userDetailsPasswordService != null
            && this.passwordEncoder.upgradeEncoding(user.getPassword());
        if (upgradeEncoding) {
            String presentedPassword = authentication.getCredentials().toString();
            String newPassword = this.passwordEncoder.encode(presentedPassword);
            user = this.userDetailsPasswordService.updatePassword(user, newPassword);
        }
        return super.createSuccessAuthentication(principal, authentication, user);
    }

	//...
}

//加載用戶特定數(shù)據(jù)的核心接口。
public interface UserDetailsService {
		//根據(jù)用戶名定位用戶
	UserDetails loadUserByUsername(String username) throws UsernameNotFoundException;
}

/**
提供核心用戶信息。
出于安全目的，Spring Security 不直接使用實現(xiàn)。 它們只是存儲用戶信息，然后將這些信息封裝到Authentication對象中。 這允許將非安全相關(guān)的用戶信息（例如電子郵件地址、電話號碼等）存儲在方便的位置。
 */
public interface UserDetails extends Serializable {
	//返回授予用戶的權(quán)限。 
	Collection<? extends GrantedAuthority> getAuthorities();
	String getPassword();
	String getUsername();

	//指示用戶的帳戶是否已過期。 無法驗證過期帳戶
	boolean isAccountNonExpired();

	//指示用戶是被鎖定還是未鎖定。 無法對鎖定的用戶進行身份驗證。
	boolean isAccountNonLocked();

	//指示用戶的憑據(jù)（密碼）是否已過期。 過期的憑據(jù)會阻止身份驗證。
	boolean isCredentialsNonExpired();

	//指示用戶是啟用還是禁用。 無法對禁用的用戶進行身份驗證。
	boolean isEnabled();
}

protected Authentication createSuccessAuthentication(Object principal, Authentication authentication,
                                                     UserDetails user) {
    UsernamePasswordAuthenticationToken result = new UsernamePasswordAuthenticationToken(principal,
                                                                                         authentication.getCredentials(), this.authoritiesMapper.mapAuthorities(user.getAuthorities()));
    result.setDetails(authentication.getDetails());
    this.logger.debug("Authenticated user");
    return result;
}

public abstract class AbstractAuthenticationProcessingFilter extends GenericFilterBean
    implements ApplicationEventPublisherAware, MessageSourceAware {
    @Override
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
        throws IOException, ServletException {
        doFilter((HttpServletRequest) request, (HttpServletResponse) response, chain);
    }

    private void doFilter(HttpServletRequest request, HttpServletResponse response, FilterChain chain)
        throws IOException, ServletException {
        if (!requiresAuthentication(request, response)) {
            chain.doFilter(request, response);
            return;
        }
        try {
            // 這里就是調(diào)用處。
            Authentication authenticationResult = attemptAuthentication(request, response);
            if (authenticationResult == null) {
                // return immediately as subclass has indicated that it hasn't completed
                return;
            }
            // session相關(guān)，這里我們不深聊
            //發(fā)生新的身份驗證時執(zhí)行與 Http 會話相關(guān)的功能。
            this.sessionStrategy.onAuthentication(authenticationResult, request, response);
            // Authentication success
            if (this.continueChainBeforeSuccessfulAuthentication) {
                chain.doFilter(request, response);
            }
            //看方法名我們就知道 這是我們需要的拉
            //成功驗證省份后調(diào)用
            successfulAuthentication(request, response, chain, authenticationResult);
        }
        catch (InternalAuthenticationServiceException failed) {
            this.logger.error("An internal error occurred while trying to authenticate the user.", failed);
            //驗證失敗調(diào)用
            unsuccessfulAuthentication(request, response, failed);
        }
        catch (AuthenticationException ex) {
            // Authentication failed
            //驗證失敗調(diào)用
            unsuccessfulAuthentication(request, response, ex);
        }
    }
}

//成功身份驗證的默認(rèn)行為。
	//1、在SecurityContextHolder上設(shè)置成功的Authentication對象
	//2、通知配置的RememberMeServices登錄成功
	//3、通過配置的ApplicationEventPublisher觸發(fā)InteractiveAuthenticationSuccessEvent
	//4、將附加行為委托給AuthenticationSuccessHandler 。
//子類可以覆蓋此方法以在身份驗證成功后繼續(xù)FilterChain 。
protected void successfulAuthentication(HttpServletRequest request, HttpServletResponse response, FilterChain chain,
                                        Authentication authResult) throws IOException, ServletException {
    //將通過驗證的Authentication保存至安全上下文
    SecurityContextHolder.getContext().setAuthentication(authResult);
    if (this.logger.isDebugEnabled()) {
        this.logger.debug(LogMessage.format("Set SecurityContextHolder to %s", authResult));
    }
    this.rememberMeServices.loginSuccess(request, response, authResult);
    if (this.eventPublisher != null) {
        this.eventPublisher.publishEvent(new InteractiveAuthenticationSuccessEvent(authResult, this.getClass()));
    }
    this.successHandler.onAuthenticationSuccess(request, response, authResult);
}