V. Spring Boot integration Spring Security certification process 2

II. Summary statement

1. As detailed aboveFourth, Spring Boot integration Spring Security certification process
2. This article focuses on the realization of the principle process of UsernamePasswordAuthenticationFilter.
3. AuthenticationManager
4. AuthenticationProvider
5. Custom Configuration of Username Password Implementation (UserDetailsService)

III. UsernamePasswordAuthenticationFilter

1. Structure and role

1. Inherit AbstractAuthenticationProcessingFilter
   1. Initialization request address
   2. Initialize authenticationManager
   3. Initialize successHandler
   4. Initialize the failureHandler
   5. Implement the filter entry doFilter method
   6. The doFilter method calls the abstract methodattemptAuthenticationThe attemptAuthentication subclass is used to fulfill the username and password authentication business.
   7. Updates the security context on successful authentication and calls the
   8. Removes the security context on authentication failure and calls the
2. realizationattemptAuthenticationmethodologies
   1. Get username and password from request
   2. Generate unauthenticated Authentication
   3. call (programming)authenticationManagerauthenticate method to complete username and password authentication.

IV. Authentication Manager (AuthenticationManager)

1. Role

1. Complete Authentication

2. ProviderManager (default implementation)

1. ProviderManager implements the AuthenticationManager interface.
2. The role of the AuthenticationManager is to complete the authentication.
3. However, the ProviderManager does not directly fulfill the Authentication
4. Instead, it provides aAuthenticationProviderset (mathematics)
5. Iterate through the AuthenticationProvider collection to complete the Authentication
6. When you need multiple authentication methods, you can register a custom AuthenticationProvider, which will be introduced later.

V. AuthenticationProvider

1. Role

• Call the interface to get user information UserDetails
• Verify that the user and password are available

2. DaoAuthenticationProvider (default implementation)

1. DaoAuthenticationProviderpredecessorAbstractUserDetailsAuthenticationProviderrealizationAuthenticationProviderconnector
2. Call the retrieveUser method to get the user information UserDetails
   1. Call to get user information UserDetails
3. Verify that the user exists and is available, and throw exceptions (expired, locked, enabled) if it doesn't exist or is unavailable
4. Verify that the password is available and throw an exception (null, expired) if it is not.
5. Verification of passwords using a password encryptor (passwords entered in the interface and passwords that have been encrypted in the database)
6. Throw an exception if the passwords don't match

VI. UserDetailsService

1. Role

• Get user details by username UserDetails
• Return user information UserDetails

2. InMemoryUserDetailsManager (default implementation)

1. A username and password are generated by default when the project starts, and are stored in memory.
2. Get the user by username and return

3, recommended implementation: custom UserDetailsService

1. Get the user from the database by username
2. Database users to UserDetails, the database is not set in the attributes like whether or not to enable, the account has not expired, the password has not expired, the account has not been locked directly set to true can be

package ;

import ;
import ;
import ;
import ;
import ;
import ;

@Service
public class UserDetailsServiceImpl implements UserDetailsService {

    //@Autowired
    //private UserService userService;

    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        //TODO pass (a bill or inspection etc)usernameGetting users from the database，redirect usersUserDetails
        //User user = (username);
        //return new User(username, (), (), (), (), (), ());
        return new User(username, "123", true, true, true, true, AuthorityUtils.NO_AUTHORITIES);
    }
}