Spring源代码解析（九）：Spring Acegi框架鉴权的实现
时间:2011-03-29 javaeye jiwenke
简单分析一下Spring Acegi的源代码实现：
Servlet.Filter的实现AuthenticationProcessingFilter启动Web页面的验证过程 - 在AbstractProcessingFilter定义了整个验证过程的模板：
Java代码
public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
throws IOException, ServletException {
//这里检验是不是符合ServletRequest/SevletResponse的要求
if (!(request instanceof HttpServletRequest)) {
throw new ServletException("Can only process HttpServletRequest");
}
if (!(response instanceof HttpServletResponse)) {
throw new ServletException("Can only process HttpServletResponse");
}
HttpServletRequest httpRequest = (HttpServletRequest) request;
HttpServletResponse httpResponse = (HttpServletResponse) response;
//根据HttpServletRequest和HttpServletResponse来进行验证
if (requiresAuthentication(httpRequest, httpResponse)) {
if (logger.isDebugEnabled()) {
logger.debug("Request is to process authentication");
}
//这里定义Acegi中的Authentication对象来持有相关的用户验证信息
Authentication authResult;
try {
onPreAuthentication(httpRequest, httpResponse);
//这里的具体验证过程委托给子类完成，比如 AuthenticationProcessingFilter来完成基于Web页面的用户验证
authResult = attemptAuthentication(httpRequest);
} catch (AuthenticationException failed) {
// Authentication failed
unsuccessfulAuthentication(httpRequest, httpResponse, failed);
return;
}
// Authentication success
if (continueChainBeforeSuccessfulAuthentication) {
chain.doFilter(request, response);
}
//完成验证后的后续工作，比如跳转到相应的页面
successfulAuthentication(httpRequest, httpResponse, authResult);
return;
}
chain.doFilter(request, response);
}
在AuthenticationProcessingFilter中的具体验证过程是这样的：
Java代码
public Authentication attemptAuthentication(HttpServletRequest request)
throws AuthenticationException {
//这里从HttpServletRequest中得到用户验证的用户名和密码
String username = obtainUsername(request);
String password = obtainPassword(request);
if (username == null) {
username = "";
}
if (password == null) {
password = "";
}
//这里根据得到的用户名和密码去构造一个Authentication对象提供给 AuthenticationManager进行验证，里面包含了用户的用户名和密码信息
UsernamePasswordAuthenticationToken authRequest = new UsernamePasswordAuthenticationToken(username, password);
// Place the last us
|
