Spring 源码分析（四）Sercurity
sschrodinger
2019/03/04
登陆验证流程
假设有如下的 spring security 配置。
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.crypto.password.NoOpPasswordEncoder;
@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {
@Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
auth
.inMemoryAuthentication()
.passwordEncoder(NoOpPasswordEncoder.getInstance())
.withUser("user_1").password("user_1").roles("USER")
.and()
.withUser("user_2").password("user_2").roles("USER");
}
@Override
protected void configure(HttpSecurity http) throws Exception {
// TODO Auto-generated method stub
http
.authorizeRequests()
.antMatchers("/resources/**").permitAll()
.antMatchers("/register").permitAll()
.anyRequest().authenticated()
.and()
.formLogin()
.loginPage("/login")
.defaultSuccessUrl("/home", true)
.permitAll();
}
@Bean
@Override
public AuthenticationManager authenticationManagerBean() throws Exception {
return super.authenticationManagerBean();
}
}
输入任意 url （非/login），流程如下：
step 1
在 Spring 中，登陆验证的逻辑始于 DelegatingFilterProxy，这是一个继承了 Filter 的类，用于实现 Java Servlet 规范的过滤器。
DelegatingFilterProxy 的 doFilter() 方法如下：
@Override
public void doFilter(ServletRequest request, ServletResponse response, FilterChain filterChain)
throws ServletException, IOException {
// Lazily initialize the delegate if necessary.
Filter delegateToUse = this.delegate;
if (delegateToUse == null) {
synchronized (this.delegateMonitor) {
delegateToUse = this.delegate;
if (delegateToUse == null) {
WebApplicationContext wac = findWebApplicationContext();
if (wac == null) {
throw new IllegalStateException("No WebApplicationContext found: " +
"no ContextLoaderListener or DispatcherServlet registered?");
}
delegateToUse = initDelegate(wac);
}
this.delegate = delegateToUse;
}
}
// Let the delegate perform the actual doFilter operation.
invokeDelegate(delegateToUse, request, response, filterChain);
}
最重要的是 invokeDelegate() 方法，Spring 所有的 Filter 逻辑都是在 invokeDelegate() 方法中完成的，所以没有 filterChain.doFilter(request, response, filterChain) 将处理过程抛出到下一 Filter。
参数 delefateToUse 包括了所有的过滤器，调试信息如下：
delegate FilterChainProxy (id=124)
|-...//其他
|-beanName "springSecurityFilterChain" (id=126)
|-filterChains ArrayList<E> (id=133)
|-elementData Object[1] (id=158)
|-[0] DefaultSecurityFilterChain (id=3344)
|-org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter@630e5010,
|-org.springframework.security.web.context.SecurityContextPersistenceFilter@4eab9aec,
|-org.springframework.security.web.header.HeaderWriterFilter@533e8807,
|-org.springframework.security.web.csrf.CsrfFilter@156eeff1,
|-org.springframework.security.web.authentication.logout.LogoutFilter@656c0eae,
|-org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter@267b678f,
|-org.springframework.security.web.savedrequest.RequestCacheAwareFilter@2c6efee3,
|-org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter@56adbb07,
|-org.springframework.security.web.authentication.AnonymousAuthenticationFilter@10b5ff4d,
|-org.springframework.security.web.session.SessionManagementFilter@2b4ba2d9,
|-org.springframework.security.web.access.ExceptionTranslationFilter@2bc0603f,
|-org.springframework.security.web.access.intercept.FilterSecurityInterceptor@4e826fd4
Spring security 的验证工作都是在 DelegatingFilterProxy 中的一个名为 springSecurityFilterChain 中完成的。
我们看 invokeDelegate() 的源码，如下：
protected void invokeDelegate(
Filter delegate, ServletRequest request, ServletResponse response, FilterChain filterChain)
throws ServletException, IOException {
delegate.doFilter(request, response, filterChain);
}
step 2
第二步进入 delegate 的 doFilter() 方法执行。
delegate 的本质是继承了 Filter 的类。维护了一个 SecurityFilterChain 列表。SecurityFilterChain 定义如下：
public interface SecurityFilterChain {
boolean matches(HttpServletRequest request);
List<Filter> getFilters();
}
在当前环境中，List<SecurityFilterChain> 只维护了一个元素。即
@Override
public void doFilter(ServletRequest request, ServletResponse response,
FilterChain chain) throws IOException, ServletException {
boolean clearContext = request.getAttribute(FILTER_APPLIED) == null;
if (clearContext) {
try {
request.setAttribute(FILTER_APPLIED, Boolean.TRUE);
doFilterInternal(request, response, chain);
}
finally {
SecurityContextHolder.clearContext();
request.removeAttribute(FILTER_APPLIED);
}
}
else {
doFilterInternal(request, response, chain);
}
}
private void doFilterInternal(ServletRequest request, ServletResponse response,
FilterChain chain) throws IOException, ServletException {
FirewalledRequest fwRequest = firewall
.getFirewalledRequest((HttpServletRequest) request);
HttpServletResponse fwResponse = firewall
.getFirewalledResponse((HttpServletResponse) response);
List<Filter> filters = getFilters(fwRequest);
if (filters == null || filters.size() == 0) {
if (logger.isDebugEnabled()) {
logger.debug(UrlUtils.buildRequestUrl(fwRequest)
+ (filters == null ? " has no matching filters"
: " has an empty filter list"));
}
fwRequest.reset();
chain.doFilter(fwRequest, fwResponse);
return;
}
VirtualFilterChain vfc = new VirtualFilterChain(fwRequest, chain, filters);
vfc.doFilter(fwRequest, fwResponse);
}
我们看 doFilter() 方法，首先，判断 request 是否有 FILTER_APPLIED 属性，如果没有，则需要添加，然后执行 doFilterInternal() 方法。
getFilters(fwRequest) 通过 url 得到符合条件的所有 filterChain 的第一个 Filter。即会得到如下 12 个 Filter:
org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter,
org.springframework.security.web.context.SecurityContextPersistenceFilter,
org.springframework.security.web.header.HeaderWriterFilter,
org.springframework.security.web.csrf.CsrfFilter,
org.springframework.security.web.authentication.logout.LogoutFilter,
org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter,
org.springframework.security.web.savedrequest.RequestCacheAwareFilter,
org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter,
org.springframework.security.web.authentication.AnonymousAuthenticationFilter,
org.springframework.security.web.session.SessionManagementFilter,
org.springframework.security.web.access.ExceptionTranslationFilter,
org.springframework.security.web.access.intercept.FilterSecurityInterceptor
变量chain代表原始 FilterChain，当 getFilters(fwRequest) 返回不为 null 时，返回值和 chain 会组合成 VirtualFilterChain，构造函数如下：
private VirtualFilterChain(FirewalledRequest firewalledRequest,
FilterChain chain, List<Filter> additionalFilters) {
this.originalChain = chain;
this.additionalFilters = additionalFilters;
this.size = additionalFilters.size();
this.firewalledRequest = firewalledRequest;
}
VirtualFilterChain 的 doFilter 函数如下：
@Override
public void doFilter(ServletRequest request, ServletResponse response)
throws IOException, ServletException {
if (currentPosition == size) {
if (logger.isDebugEnabled()) {
logger.debug(UrlUtils.buildRequestUrl(firewalledRequest)
+ " reached end of additional filter chain; proceeding with original chain");
}
// Deactivate path stripping as we exit the security filter chain
this.firewalledRequest.reset();
originalChain.doFilter(request, response);
}
else {
//currrent addition filter pos， init is zero
currentPosition++;
Filter nextFilter = additionalFilters.get(currentPosition - 1);
if (logger.isDebugEnabled()) {
logger.debug(UrlUtils.buildRequestUrl(firewalledRequest)
+ " at position " + currentPosition + " of " + size
+ " in additional filter chain; firing Filter: '"
+ nextFilter.getClass().getSimpleName() + "'");
}
nextFilter.doFilter(request, response, this);
}
}
注意，当执行 VirtualFilterChain 的 doFilter 函数时，会先执行 else 语句，currentPosition 先自加，然后将自身作为参数执行 nextFilter 的 dofilter() 方法，这样就会重复执行 else 语句，将所有的 additionalFilter 全部执行完。
step 3
执行所有 VirtualFilterChain 中的 Filter。
nextFilter() 依次执行如下 12 个 Filter。
1.WebAsyncManagerIntegrationFilter
2.SecurityContextPersistenceFilter
3.HeaderWriterFilter
4.CsrfFilter
5.LogoutFilter
6.UsernamePasswordAuthenticationFilter
7.RequestCacheAwareFilter
8.SecurityContextHolderAwareRequestFilter
9.AnonymousAuthenticationFilter
10.SessionManagementFilter
11.ExceptionTranslationFilter
12.FilterSecurityInterceptor
其中比较重要的是2，5，6，9，12三个 filter。
SecurityContextPersistenceFilter 主要是对保存的密码信息等做持久化处理。
LogoutFilter 主要是匹配退出 url 并作退出处理逻辑。
UsernamePasswordAuthenticationFilter 主要作用是当匹配登录界面时，做一些登陆的操作，否则直接到下一过滤器。
AnonymousAuthenticationFilter 主要作用是当没有进行登陆时，自动创建匿名用户。
FilterSecurityInterceptor 继承了 AbstractSecurityInterceptor，主要用于登陆的核心逻辑。
note(AbstractSecurityInterceptor api note)
- Abstract class that implements security interception for secure objects.
- The AbstractSecurityInterceptor will ensure the proper startupconfiguration of the security interceptor. It will also implement the proper handlingof secure object invocations, namely:
- Obtain the Authentication object from the SecurityContextHolder.
- Determine if the request relates to a secured or public invocation by looking upthe secure object request against the SecurityMetadataSource.
- For an invocation that is secured (there is a list of ConfigAttributesfor the secure object invocation):
- If either the org.springframework.security.core.Authentication.isAuthenticated() returns false, or the alwaysReauthenticate is true,authenticate the request against the configured AuthenticationManager. Whenauthenticated, replace the Authentication object on the SecurityContextHolder with the returned value.
- Authorize the request against the configured AccessDecisionManager.
- Perform any run-as replacement via the configured RunAsManager.
- Pass control back to the concrete subclass, which will actually proceed withexecuting the object. A InterceptorStatusToken is returned so that after thesubclass has finished proceeding with execution of the object, its finally clause canensure the AbstractSecurityInterceptor is re-called and tidies upcorrectly using finallyInvocation(InterceptorStatusToken).
- The concrete subclass will re-call the AbstractSecurityInterceptor viathe afterInvocation(InterceptorStatusToken, Object) method.
- If the RunAsManager replaced the Authentication object,return the SecurityContextHolder to the object that existed after the callto AuthenticationManager.
- If an AfterInvocationManager is defined, invoke the invocation managerand allow it to replace the object due to be returned to the caller.
- For an invocation that is public (there are no ConfigAttributes forthe secure object invocation):
- As described above, the concrete subclass will be returned an InterceptorStatusToken which is subsequently re-presented to the AbstractSecurityInterceptor after the secure object has been executed. The AbstractSecurityInterceptor will take no further action when its afterInvocation(InterceptorStatusToken, Object) is called.
- Control again returns to the concrete subclass, along with the Objectthat should be returned to the caller. The subclass will then return that result orexception to the original caller.
FilterSecurityInterceptor 的 invoke() 方法如下：
public void invoke(FilterInvocation fi) throws IOException, ServletException {
if ((fi.getRequest() != null)
&& (fi.getRequest().getAttribute(FILTER_APPLIED) != null)
&& observeOncePerRequest) {
// filter already applied to this request and user wants us to observe
// once-per-request handling, so don't re-do security checking
fi.getChain().doFilter(fi.getRequest(), fi.getResponse());
}
else {
// first time this request being called, so perform security checking
if (fi.getRequest() != null && observeOncePerRequest) {
fi.getRequest().setAttribute(FILTER_APPLIED, Boolean.TRUE);
}
InterceptorStatusToken token = super.beforeInvocation(fi);
try {
fi.getChain().doFilter(fi.getRequest(), fi.getResponse());
}
finally {
super.finallyInvocation(token);
}
super.afterInvocation(token, null);
}
}
beforeInvocation() 函数的处理逻辑是先验证，如果不满足条件，则抛出 accessDeniedException 错误，否则生成 InterceptorStatusToken 给上一级。
protected InterceptorStatusToken beforeInvocation(Object object) {
Assert.notNull(object, "Object was null");
final boolean debug = logger.isDebugEnabled();
if (!getSecureObjectClass().isAssignableFrom(object.getClass())) {
throw new IllegalArgumentException(
"Security invocation attempted for object "
+ object.getClass().getName()
+ " but AbstractSecurityInterceptor only configured to support secure objects of type: "
+ getSecureObjectClass());
}
Collection<ConfigAttribute> attributes = this.obtainSecurityMetadataSource()
.getAttributes(object);
if (attributes == null || attributes.isEmpty()) {
if (rejectPublicInvocations) {
throw new IllegalArgumentException(
"Secure object invocation "
+ object
+ " was denied as public invocations are not allowed via this interceptor. "
+ "This indicates a configuration error because the "
+ "rejectPublicInvocations property is set to 'true'");
}
if (debug) {
logger.debug("Public object - authentication not attempted");
}
publishEvent(new PublicInvocationEvent(object));
return null; // no further work post-invocation
}
if (SecurityContextHolder.getContext().getAuthentication() == null) {
credentialsNotFound(messages.getMessage(
"AbstractSecurityInterceptor.authenticationNotFound",
"An Authentication object was not found in the SecurityContext"),
object, attributes);
}
Authentication authenticated = authenticateIfRequired();
// Attempt authorization
try {
this.accessDecisionManager.decide(authenticated, object, attributes);
}
catch (AccessDeniedException accessDeniedException) {
publishEvent(new AuthorizationFailureEvent(object, attributes, authenticated,
accessDeniedException));
throw accessDeniedException;
}
if (debug) {
logger.debug("Authorization successful");
}
if (publishAuthorizationSuccess) {
publishEvent(new AuthorizedEvent(object, attributes, authenticated));
}
// Attempt to run as a different user
Authentication runAs = this.runAsManager.buildRunAs(authenticated, object,
attributes);
if (runAs == null) {
if (debug) {
logger.debug("RunAsManager did not change Authentication object");
}
// no further work post-invocation
return new InterceptorStatusToken(SecurityContextHolder.getContext(), false,
attributes, object);
}
else {
if (debug) {
logger.debug("Switching to RunAs Authentication: " + runAs);
}
SecurityContext origCtx = SecurityContextHolder.getContext();
SecurityContextHolder.setContext(SecurityContextHolder.createEmptyContext());
SecurityContextHolder.getContext().setAuthentication(runAs);
// need to revert to token.Authenticated post-invocation
return new InterceptorStatusToken(origCtx, true, attributes, object);
}
}
ExceptionTranslationFilter 会捕捉 FilterSecurityInterceptor 抛出的错误，并进行错误处理。错误处理语句如下：
catch (Exception ex) {
// Try to extract a SpringSecurityException from the stacktrace
Throwable[] causeChain = throwableAnalyzer.determineCauseChain(ex);
RuntimeException ase = (AuthenticationException) throwableAnalyzer
.getFirstThrowableOfType(AuthenticationException.class, causeChain);
if (ase == null) {
ase = (AccessDeniedException) throwableAnalyzer.getFirstThrowableOfType(
AccessDeniedException.class, causeChain);
}
if (ase != null) {
if (response.isCommitted()) {
throw new ServletException("Unable to handle the Spring Security Exception because the response is already committed.", ex);
}
handleSpringSecurityException(request, response, chain, ase);
}
else {
// Rethrow ServletExceptions and RuntimeExceptions as-is
if (ex instanceof ServletException) {
throw (ServletException) ex;
}
else if (ex instanceof RuntimeException) {
throw (RuntimeException) ex;
}
// Wrap other Exceptions. This shouldn't actually happen
// as we've already covered all the possibilities for doFilter
throw new RuntimeException(ex);
}
}
错误的主要处理过程在 handleSpringSecurityException(request, response, chain, ase) 中，如下：
private void handleSpringSecurityException(HttpServletRequest request,
HttpServletResponse response, FilterChain chain, RuntimeException exception)
throws IOException, ServletException {
if (exception instanceof AuthenticationException) {
logger.debug(
"Authentication exception occurred; redirecting to authentication entry point",
exception);
sendStartAuthentication(request, response, chain,
(AuthenticationException) exception);
} else if (exception instanceof AccessDeniedException) {
Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
if (authenticationTrustResolver.isAnonymous(authentication) || authenticationTrustResolver.isRememberMe(authentication)) {
logger.debug(
"Access is denied (user is " + (authenticationTrustResolver.isAnonymous(authentication) ? "anonymous" : "not fully authenticated") + "); "redirecting to authentication entry point",
exception);
sendStartAuthentication(
request,
response,
chain,
new InsufficientAuthenticationException(
messages.getMessage(
"ExceptionTranslationFilter.insufficientAuthentication",
"Full authentication is required to access this resource")));
} else {
logger.debug(
"Access is denied (user is not anonymous); delegating to AccessDeniedHandler",
exception);
accessDeniedHandler.handle(request, response,
(AccessDeniedException) exception);
}
}
}
在 sendStartAuthentication 函数中，会对连接进行重定向到规定的登陆界面。
如在 /login 界面利用 POST 提交表单信息登陆。流程的 step 1 和 step 2 和上相同，step 3 略有区别。在执行到 UsernamePasswordAuthenticationFilter 时，就会进行登陆逻辑，代码如下：
public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain)
throws IOException, ServletException {
HttpServletRequest request = (HttpServletRequest) req;
HttpServletResponse response = (HttpServletResponse) res;
if (!requiresAuthentication(request, response)) {
chain.doFilter(request, response);
return;
}
if (logger.isDebugEnabled()) {
logger.debug("Request is to process authentication");
}
Authentication authResult;
try {
authResult = attemptAuthentication(request, response);
if (authResult == null) {
// return immediately as subclass has indicated that it hasn't completed
// authentication
return;
}
sessionStrategy.onAuthentication(authResult, request, response);
}
catch (InternalAuthenticationServiceException failed) {
logger.error(
"An internal error occurred while trying to authenticate the user.",
failed);
unsuccessfulAuthentication(request, response, failed);
return;
}
catch (AuthenticationException failed) {
// Authentication failed
unsuccessfulAuthentication(request, response, failed);
return;
}
// Authentication success
if (continueChainBeforeSuccessfulAuthentication) {
chain.doFilter(request, response);
}
successfulAuthentication(request, response, chain, authResult);
}
具体逻辑是 attemptAuthentication() 函数进行验证，当验证成功时，执行 successfulAuthentication(request, response, chain, authResult) 进行跳转，失败时，执行 unsuccessfulAuthentication(request, response, failed) 进行跳转，假如设置了跳转地址，则回继续调用 doFilter() 方法，在 FilterSecurityInterceptor 中利用UserNamePasswordToken 进行授权。
综上，时序图(关键类)如下：
spring security
