public class AuthenticationExample {
    private static AuthenticationManager am = new SampleAuthenticationManager();
    public static void main(String[] args) throws IOException {
        BufferedReader in = new BufferedReader(new InputStreamReader(System.in));
        while (true) {
            System.out.println("please enter your username:");
            String name = in.readLine();
            System.out.println("please enter your password:");
            String password = null;
            password = in.readLine();
            try {
                // 封裝認證信息，未認證通過
                UsernamePasswordAuthenticationToken request = new UsernamePasswordAuthenticationToken(name, password);
                // 認證邏輯
                Authentication result = am.authenticate(request);
                //當前線程綁定認證信息
                SecurityContextHolder.getContext().setAuthentication(result);
                break;
            } catch (AuthenticationException e) {
                System.out.println("Authentication failed: " + e.getMessage());
            }
        }
    }
    static class SampleAuthenticationManager implements AuthenticationManager {
        static final List<GrantedAuthority> AUTHORITIES = new ArrayList<GrantedAuthority>();
        static {
            AUTHORITIES.add(new SimpleGrantedAuthority("ROLE_USER"));
        }
        @Override
        public Authentication authenticate(Authentication authentication) throws AuthenticationException {
            // 判斷條件，用戶名和密碼是否相同
            if (authentication.getName().equals(authentication.getCredentials())){
                return new UsernamePasswordAuthenticationToken(authentication.getName(),authentication.getCredentials(),AUTHORITIES);
            }
            throw new BadCredentialsException("Bad Credentials");
        }
    }
}

public class UsernamePasswordAuthenticationFilter extends
		AbstractAuthenticationProcessingFilter {
	// ~ Static fields/initializers
	// =====================================================================================
	//從登錄請求中獲取參數：username,password的名字
	public static final String SPRING_SECURITY_FORM_USERNAME_KEY = "username";
	public static final String SPRING_SECURITY_FORM_PASSWORD_KEY = "password";
	private String usernameParameter = SPRING_SECURITY_FORM_USERNAME_KEY;
	private String passwordParameter = SPRING_SECURITY_FORM_PASSWORD_KEY;
	//默認支持POST登錄
	private boolean postOnly = true;
	//默認攔截/login請求，Post方式
	public UsernamePasswordAuthenticationFilter() {
		super(new AntPathRequestMatcher("/login", "POST"));
	}
	// ~ Methods
	// ========================================================================================================
	public Authentication attemptAuthentication(HttpServletRequest request,
			HttpServletResponse response) throws AuthenticationException {
			//判斷請求是否是POST
		if (postOnly && !request.getMethod().equals("POST")) {
			throw new AuthenticationServiceException(
					"Authentication method not supported: " + request.getMethod());
		}
		//獲取到用戶名和密碼
		String username = obtainUsername(request);
		String password = obtainPassword(request);
		if (username == null) {
			username = "";
		}
		if (password == null) {
			password = "";
		}
		username = username.trim();
		//用戶名和密碼封裝Token
		UsernamePasswordAuthenticationToken authRequest = new UsernamePasswordAuthenticationToken(
				username, password);
		//設置details屬性
		// Allow subclasses to set the "details" property
		setDetails(request, authRequest);
		//調用AuthenticationManager().authenticate進行認證，參數就是Token對象
		return this.getAuthenticationManager().authenticate(authRequest);
	}

public class ProviderManager implements AuthenticationManager, MessageSourceAware,
		InitializingBean {
		...省略...
		//這里authentication 是封裝了登錄請求的認證參數，
		//即：UsernamePasswordAuthenticationFilter傳入的Token對象
	public Authentication authenticate(Authentication authentication)
			throws AuthenticationException {
		Class<? extends Authentication> toTest = authentication.getClass();
		AuthenticationException lastException = null;
		AuthenticationException parentException = null;
		Authentication result = null;
		Authentication parentResult = null;
		boolean debug = logger.isDebugEnabled();
		//找到所有的AuthenticationProvider ，選擇合適的進行認證
		for (AuthenticationProvider provider : getProviders()) {
			//是否支持當前認證
			if (!provider.supports(toTest)) {
				continue;
			}
```java
		if (debug) {
			logger.debug("Authentication attempt using "
					+ provider.getClass().getName());
		}
		try {
			//調用provider執(zhí)行認證
			result = provider.authenticate(authentication);
			if (result != null) {
				copyDetails(authentication, result);
				break;
			}
		}
			...省略...
	}
	...省略...
	//result就是Authentication ，使用的實現類依然是UsernamepasswordAuthenticationToken，
	//封裝了認證成功后的用戶的認證信息和授權信息
	if (result != null) {
		if (eraseCredentialsAfterAuthentication
			&& (result instanceof CredentialsContainer)) {
		// Authentication is complete. Remove credentials and other secret data
		// from authentication
		//這里在擦除登錄密碼
		((CredentialsContainer) result).eraseCredentials();
	}
	// If the parent AuthenticationManager was attempted and successful than it will publish an AuthenticationSuccessEvent
	// This check prevents a duplicate AuthenticationSuccessEvent if the parent AuthenticationManager already published it
	if (parentResult == null) {
		//發(fā)布事件
		eventPublisher.publishAuthenticationSuccess(result);
	}
	return result;
}

public class DaoAuthenticationProvider extends AbstractUserDetailsAuthenticationProvider {
		//密碼編碼器
		private PasswordEncoder passwordEncoder;
		//UserDetailsService ，根據用戶名加載UserDetails對象，從數據庫加載的認證授權信息
		private UserDetailsService userDetailsService;
		//認證檢查方法
		protected void additionalAuthenticationChecks(UserDetails userDetails,
			UsernamePasswordAuthenticationToken authentication)
			throws AuthenticationException {
		if (authentication.getCredentials() == null) {
			logger.debug("Authentication failed: no credentials provided");
```java
		throw new BadCredentialsException(messages.getMessage(
				"AbstractUserDetailsAuthenticationProvider.badCredentials",
				"Bad credentials"));
	}
	//獲取密碼
	String presentedPassword = authentication.getCredentials().toString();
	//通過passwordEncoder比較密碼，presentedPassword是用戶傳入的密碼，userDetails.getPassword()是從數據庫加載到的密碼
	//passwordEncoder編碼器不一樣比較密碼的方式也不一樣
	if (!passwordEncoder.matches(presentedPassword, userDetails.getPassword())) {
		logger.debug("Authentication failed: password does not match stored value");
		throw new BadCredentialsException(messages.getMessage(
				"AbstractUserDetailsAuthenticationProvider.badCredentials",
				"Bad credentials"));
	}
}
//檢索用戶，參數為用戶名和Token對象
protected final UserDetails retrieveUser(String username,
		UsernamePasswordAuthenticationToken authentication)
		throws AuthenticationException {
	prepareTimingAttackProtection();
	try {
		//調用UserDetailsService的loadUserByUsername方法，
		//根據用戶名檢索數據庫中的用戶，封裝成UserDetails 
		UserDetails loadedUser = this.getUserDetailsService().loadUserByUsername(username);
		if (loadedUser == null) {
			throw new InternalAuthenticationServiceException(
					"UserDetailsService returned null, which is an interface contract violation");
		}
		return loadedUser;
	}
	catch (UsernameNotFoundException ex) {
		mitigateAgainstTimingAttack(authentication);
		throw ex;
	}
	catch (InternalAuthenticationServiceException ex) {
		throw ex;
	}
	catch (Exception ex) {
		throw new InternalAuthenticationServiceException(ex.getMessage(), ex);
	}
}
//創(chuàng)建認證成功的認證對象Authentication，使用的實現是UsernamepasswordAuthenticationToken,
//封裝了認證成功后的認證信息和授權信息，以及賬戶的狀態(tài)等
@Override
protected Authentication createSuccessAuthentication(Object principal,
		Authentication authentication, UserDetails user) {
	boolean upgradeEncoding = this.userDetailsPasswordService != null
			&& this.passwordEncoder.upgradeEncoding(user.getPassword());
	if (upgradeEncoding) {
		String presentedPassword = authentication.getCredentials().toString();
		String newPassword = this.passwordEncoder.encode(presentedPassword);
		user = this.userDetailsPasswordService.updatePassword(user, newPassword);
	}
	return super.createSuccessAuthentication(principal, authentication, user);
}
...省略...

public abstract class AbstractUserDetailsAuthenticationProvider implements
		AuthenticationProvider, InitializingBean, MessageSourceAware {
		//認證邏輯
		public Authentication authenticate(Authentication authentication)
			throws AuthenticationException {
			//得到傳入的用戶名
			String username = (authentication.getPrincipal() == null) ? "NONE_PROVIDED"
				: authentication.getName();
				//從緩存中得到UserDetails
			boolean cacheWasUsed = true;
			UserDetails user = this.userCache.getUserFromCache(username);
			if (user == null) {
			cacheWasUsed = false;
```java
		try {
			//檢索用戶，底層會調用UserDetailsService加載數據庫中的UserDetails對象，保護認證信息和授權信息
			user = retrieveUser(username,
					(UsernamePasswordAuthenticationToken) authentication);
		}
		catch (UsernameNotFoundException notFound) {
			...省略...
		}
		try {
			//前置檢查，主要檢查賬戶是否鎖定，賬戶是否過期等
			preAuthenticationChecks.check(user);
			//比對密碼在這個方法里面比對的
			additionalAuthenticationChecks(user,
				(UsernamePasswordAuthenticationToken) authentication);
		}
		catch (AuthenticationException exception) {
		...省略...
		}
		//后置檢查
		postAuthenticationChecks.check(user);
		if (!cacheWasUsed) {
			//設置UserDetails緩存
			this.userCache.putUserInCache(user);
		}
		Object principalToReturn = user;
		if (forcePrincipalAsString) {
			principalToReturn = user.getUsername();
		}
		//認證成功，創(chuàng)建Auhentication認證對象
		return createSuccessAuthentication(principalToReturn, authentication, user);
}

認證成功，請求會重新回到UsernamePasswordAuthenticationFilter，然后會通過其父類AbstractAuthenticationProcessingFilter.successfulAuthentication方法將認證對象封裝成SecurityContext設置到SecurityContextHolder中
protected void successfulAuthentication(HttpServletRequest request,
			HttpServletResponse response, FilterChain chain, Authentication authResult)
			throws IOException, ServletException {
```java
	if (logger.isDebugEnabled()) {
		logger.debug("Authentication success. Updating SecurityContextHolder to contain: "
				+ authResult);
	}
	//認證成功，吧Authentication 設置到SecurityContextHolder
	SecurityContextHolder.getContext().setAuthentication(authResult);
	//處理記住我業(yè)務邏輯
	rememberMeServices.loginSuccess(request, response, authResult);
	// Fire event
	if (this.eventPublisher != null) {
		eventPublisher.publishEvent(new InteractiveAuthenticationSuccessEvent(
				authResult, this.getClass()));
	}
	//重定向登錄成功地址
	successHandler.onAuthenticationSuccess(request, response, authResult);
}