春靴中的Spring安全困惑

Question

UserDetails usd=this.myCustomUserDetailService.loadByUserName(userNameFromToke);//userNameFromToke is a String that got extracted from the token that client provided.

UsernamePasswordAuthenticationToken upat=new UsernamePasswordAuthenticationToken(usd,null,usd.getAuthorities()); //Here in the password I am passing null.

upat.setDetails(new WebAuthenticationDetailsSource().buildDetails(httpRequest));

SecurityContextHolder.getContext().setAuthentication(upat);

`ups.setDetails(new WebAuthenticationDetailsSource().buildDetails(httpRequest));`

setAuthentication方法和UsernamePasswordAuthenticationToken是如何工作的？我正在传递从令牌中提取的信息，即securityContextHolder.getContext().setAuthentication(upat)；以及UsernamePasswordAuthenticationToken构造函数中的userdetails、passowords和权限，但它验证的是“upat”？UsernamePasswordAuthenticationToken是否自动使用“MyCustomUserDetailService”进行内部检查？

我知道这个问题有点冗长，但作为一个初学者，我正在努力理解它背后的机制，我已经对它进行了研究，但这种困惑并没有消失。请帮忙。另外，如果你觉得我的问题有问题，建议我如何简明我的问题。

Answer 1

>

UsernamePasswordAuthenticationToken中的详细信息完全由您决定，如果您稍后在应用程序中需要通过身份验证的用户提供更多详细信息，这将非常有用。与调用SecurityContextHolder.getContext().getAuthentication()类似，您可以将此Authentication强制转换为UsernamePasswordAuthenticationToken并出于任何业务目的访问其详细信息；

您的UsernamePasswordAuthenticationToken没有进行任何验证，您需要通过调用UserDetailsService并检查密码，或者插入并调用AuthenticationManager#Authenticate方法手动进行验证。Spring Security并不关心如何填充SecurityContextHolder。在基本方案中，在将经过身份验证的SecurityContext设置到SecurityContextThold后，SecurityContext将接受此SecurityContext并将其作为属性保存在HttpSession中。在接下来的请求中，此属性将出现在HttpSession中，这样Spring Security将加载SecurityContext并将其设置到SecurityContextHolder中。

您可以在SecurityContextPersistenceFilter实现中获得更多细节，但我将在这里指出这个问题的具体部分：

HttpRequestResponseHolder holder = new HttpRequestResponseHolder(request, response);
// Here Spring Security loads the SecurityContext from the HttpSession, this is done before reaching your controllers, before calling the FilterChain.
SecurityContext contextBeforeChainExecution = this.repo.loadContext(holder); 
try {
    SecurityContextHolder.setContext(contextBeforeChainExecution);
    if (contextBeforeChainExecution.getAuthentication() == null) {
        logger.debug("Set SecurityContextHolder to empty SecurityContext");
    }
    else {
        if (this.logger.isDebugEnabled()) {
            this.logger
                        .debug(LogMessage.format("Set SecurityContextHolder to %s", contextBeforeChainExecution));
        }
    }
    chain.doFilter(holder.getRequest(), holder.getResponse());
}
finally {
    // You've populated the SecurityContextHolder and it'll be available here after you application returns. So it'll get the SecurityContext and persist it in the HttpSession
    SecurityContext contextAfterChainExecution = SecurityContextHolder.getContext();
    SecurityContextHolder.clearContext();
    // Persisting the SecurityContext in the HttpSession
    this.repo.saveContext(contextAfterChainExecution, holder.getRequest(), holder.getResponse());
    request.removeAttribute(FILTER_APPLIED);
    this.logger.debug("Cleared SecurityContextHolder to complete request");
}