Spring Security系列之授權過程(七)

蔣老溼發表於2018-12-19

Spring

前言

本文是接上一章Spring Security系列之認證過程(六)進一步分析Spring Security使用者名稱密碼登入授權是如何實現得；

類圖

除錯過程

使用debug方式啟動https://github.com/longfeizheng/logback該專案，瀏覽器輸入http://localhost:8080/persons,使用者名稱隨意，密碼123456即可；

原始碼分析

如圖所示，顯示了登入認證過程中的 filters 相關的呼叫流程，將幾個自認為重要的 filters 標註了出來，

從圖中可以看出執行的順序。來看看幾個作者認為比較重要的 Filter 的處理邏輯，UsernamePasswordAuthenticationFilter，AnonymousAuthenticationFilter，ExceptionTranslationFilter，FilterSecurityInterceptor 以及相關的處理流程如下所述；

UsernamePasswordAuthenticationFilter

整個呼叫流程是，先呼叫其父類 AbstractAuthenticationProcessingFilter.doFilter() 方法，然後再執行 UsernamePasswordAuthenticationFilter.attemptAuthentication() 方法進行驗證；

AbstractAuthenticationProcessingFilter

public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain)
			throws IOException, ServletException {

		HttpServletRequest request = (HttpServletRequest) req;
		HttpServletResponse response = (HttpServletResponse) res;
		#1.判斷當前的filter是否可以處理當前請求，不可以的話則交給下一個filter處理
		if (!requiresAuthentication(request, response)) {
			chain.doFilter(request, response);

			return;
		}

		if (logger.isDebugEnabled()) {
			logger.debug("Request is to process authentication");
		}

		Authentication authResult;

		try {
			#2.抽象方法由子類UsernamePasswordAuthenticationFilter實現
			authResult = attemptAuthentication(request, response);
			if (authResult == null) {
				// return immediately as subclass has indicated that it hasn't completed
				// authentication
				return;
			}
			#2.認證成功後，處理一些與session相關的方法 
			sessionStrategy.onAuthentication(authResult, request, response);
		}
		catch (InternalAuthenticationServiceException failed) {
			logger.error(
					"An internal error occurred while trying to authenticate the user.",
					failed);
			#3.認證失敗後的的一些操作
			unsuccessfulAuthentication(request, response, failed);

			return;
		}
		catch (AuthenticationException failed) {
			// Authentication failed
			unsuccessfulAuthentication(request, response, failed);

			return;
		}

		// Authentication success
		if (continueChainBeforeSuccessfulAuthentication) {
			chain.doFilter(request, response);
		}
		#3. 認證成功後的相關回撥方法 主要將當前的認證放到SecurityContextHolder中
		successfulAuthentication(request, response, chain, authResult);
	}
複製程式碼

整個程式的執行流程如下:

判斷filter是否可以處理當前的請求，如果不可以則放行交給下一個filter
呼叫抽象方法attemptAuthentication進行驗證，該方法由子類UsernamePasswordAuthenticationFilter實現
認證成功以後，回撥一些與 session 相關的方法；

認證成功以後，認證成功後的相關回撥方法；認證成功以後，認證成功後的相關回撥方法；

protected void successfulAuthentication(HttpServletRequest request,
         HttpServletResponse response, FilterChain chain, Authentication authResult)
         throws IOException, ServletException {

     if (logger.isDebugEnabled()) {
         logger.debug("Authentication success. Updating SecurityContextHolder to contain: "
                 + authResult);
     }

     SecurityContextHolder.getContext().setAuthentication(authResult);

     rememberMeServices.loginSuccess(request, response, authResult);

     // Fire event
     if (this.eventPublisher != null) {
         eventPublisher.publishEvent(new InteractiveAuthenticationSuccessEvent(
                 authResult, this.getClass()));
     }

     successHandler.onAuthenticationSuccess(request, response, authResult);
 }
複製程式碼

將當前認證成功的 Authentication 放置到 SecurityContextHolder 中；
將當前認證成功的 Authentication 放置到 SecurityContextHolder 中；
呼叫其它可擴充套件的 handlers 繼續處理該認證成功以後的回撥事件；（實現AuthenticationSuccessHandler介面即可）

UsernamePasswordAuthenticationFilter

public Authentication attemptAuthentication(HttpServletRequest request,
			HttpServletResponse response) throws AuthenticationException {
		#1.判斷請求的方法必須為POST請求
		if (postOnly && !request.getMethod().equals("POST")) {
			throw new AuthenticationServiceException(
					"Authentication method not supported: " + request.getMethod());
		}
		#2.從request中獲取username和password
		String username = obtainUsername(request);
		String password = obtainPassword(request);

		if (username == null) {
			username = "";
		}

		if (password == null) {
			password = "";
		}

		username = username.trim();
		#3.構建UsernamePasswordAuthenticationToken（兩個引數的構造方法setAuthenticated(false)）
		UsernamePasswordAuthenticationToken authRequest = new UsernamePasswordAuthenticationToken(
				username, password);

		// Allow subclasses to set the "details" property
		setDetails(request, authRequest);
		#4. 呼叫 AuthenticationManager 進行驗證（子類ProviderManager遍歷所有的AuthenticationProvider認證）
		return this.getAuthenticationManager().authenticate(authRequest);
	}
複製程式碼

認證請求的方法必須為POST
從request中獲取 username 和 password
封裝Authenticaiton的實現類UsernamePasswordAuthenticationToken，（UsernamePasswordAuthenticationToken呼叫兩個引數的構造方法setAuthenticated(false)）
呼叫 AuthenticationManager 的 authenticate 方法進行驗證；可參考ProviderManager部分；

AnonymousAuthenticationFilter

從上圖中過濾器的執行順序圖中可以看出AnonymousAuthenticationFilter過濾器是在UsernamePasswordAuthenticationFilter等過濾器之後，如果它前面的過濾器都沒有認證成功，Spring Security則為當前的SecurityContextHolder中新增一個Authenticaiton 的匿名實現類AnonymousAuthenticationToken;

public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain)
			throws IOException, ServletException {
		#1.如果前面的過濾器都沒認證通過，則SecurityContextHolder中Authentication為空
		if (SecurityContextHolder.getContext().getAuthentication() == null) {
			#2.為當前的SecurityContextHolder中新增一個匿名的AnonymousAuthenticationToken
			SecurityContextHolder.getContext().setAuthentication(
					createAuthentication((HttpServletRequest) req));

			if (logger.isDebugEnabled()) {
				logger.debug("Populated SecurityContextHolder with anonymous token: '"
						+ SecurityContextHolder.getContext().getAuthentication() + "'");
			}
		}
		else {
			if (logger.isDebugEnabled()) {
				logger.debug("SecurityContextHolder not populated with anonymous token, as it already contained: '"
						+ SecurityContextHolder.getContext().getAuthentication() + "'");
			}
		}

		chain.doFilter(req, res);
	}

	#3.建立匿名的AnonymousAuthenticationToken
	protected Authentication createAuthentication(HttpServletRequest request) {
		AnonymousAuthenticationToken auth = new AnonymousAuthenticationToken(key,
				principal, authorities);
		auth.setDetails(authenticationDetailsSource.buildDetails(request));

		return auth;
	}
	
		/**
	 * Creates a filter with a principal named "anonymousUser" and the single authority
	 * "ROLE_ANONYMOUS".
	 *
	 * @param key the key to identify tokens created by this filter
	 */
	 ##.建立一個使用者名稱為anonymousUser 授權為ROLE_ANONYMOUS
	public AnonymousAuthenticationFilter(String key) {
		this(key, "anonymousUser", AuthorityUtils.createAuthorityList("ROLE_ANONYMOUS"));
	}
複製程式碼

判斷SecurityContextHolder中Authentication為否為空；
如果空則為當前的SecurityContextHolder中新增一個匿名的AnonymousAuthenticationToken（使用者名稱為 anonymousUser 的AnonymousAuthenticationToken）

ExceptionTranslationFilter

ExceptionTranslationFilter 異常處理過濾器,該過濾器用來處理在系統認證授權過程中丟擲的異常（也就是下一個過濾器FilterSecurityInterceptor）,主要是處理 AuthenticationException 和AccessDeniedException 。

public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain)
			throws IOException, ServletException {
		HttpServletRequest request = (HttpServletRequest) req;
		HttpServletResponse response = (HttpServletResponse) res;

		try {
			chain.doFilter(request, response);

			logger.debug("Chain processed normally");
		}
		catch (IOException ex) {
			throw ex;
		}
		catch (Exception ex) {
			// Try to extract a SpringSecurityException from the stacktrace
			#.判斷是不是AuthenticationException
			Throwable[] causeChain = throwableAnalyzer.determineCauseChain(ex);
			RuntimeException ase = (AuthenticationException) throwableAnalyzer
					.getFirstThrowableOfType(AuthenticationException.class, causeChain);

			if (ase == null) {
				#. 判斷是不是AccessDeniedException
				ase = (AccessDeniedException) throwableAnalyzer.getFirstThrowableOfType(
						AccessDeniedException.class, causeChain);
			}

			if (ase != null) {
				handleSpringSecurityException(request, response, chain, ase);
			}
			else {
				// Rethrow ServletExceptions and RuntimeExceptions as-is
				if (ex instanceof ServletException) {
					throw (ServletException) ex;
				}
				else if (ex instanceof RuntimeException) {
					throw (RuntimeException) ex;
				}

				// Wrap other Exceptions. This shouldn't actually happen
				// as we've already covered all the possibilities for doFilter
				throw new RuntimeException(ex);
			}
		}
	}
複製程式碼

FilterSecurityInterceptor

此過濾器為認證授權過濾器鏈中最後一個過濾器，該過濾器之後就是請求真正的/persons 服務

public void doFilter(ServletRequest request, ServletResponse response,
			FilterChain chain) throws IOException, ServletException {
		FilterInvocation fi = new FilterInvocation(request, response, chain);
		invoke(fi);
	}

public void invoke(FilterInvocation fi) throws IOException, ServletException {
		if ((fi.getRequest() != null)
				&& (fi.getRequest().getAttribute(FILTER_APPLIED) != null)
				&& observeOncePerRequest) {
			// filter already applied to this request and user wants us to observe
			// once-per-request handling, so don't re-do security checking
			fi.getChain().doFilter(fi.getRequest(), fi.getResponse());
		}
		else {
			// first time this request being called, so perform security checking
			if (fi.getRequest() != null) {
				fi.getRequest().setAttribute(FILTER_APPLIED, Boolean.TRUE);
			}
			#1. before invocation重要
			InterceptorStatusToken token = super.beforeInvocation(fi);

			try {
				#2. 可以理解開始請求真正的 /persons 服務
				fi.getChain().doFilter(fi.getRequest(), fi.getResponse());
			}
			finally {
				super.finallyInvocation(token);
			}
			#3. after Invocation
			super.afterInvocation(token, null);
		}
	}
複製程式碼

before invocation重要
請求真正的 /persons 服務
after Invocation

三個部分中，最重要的是 #1，該過程中會呼叫 AccessDecisionManager 來驗證當前已認證成功的使用者是否有許可權訪問該資源；

AccessDecisionManager: beforeInvocation

protected InterceptorStatusToken beforeInvocation(Object object) {
		...

		Collection<ConfigAttribute> attributes = this.obtainSecurityMetadataSource()
				.getAttributes(object);

		...
		Authentication authenticated = authenticateIfRequired();

		// Attempt authorization
		try {
			#1.重點
			this.accessDecisionManager.decide(authenticated, object, attributes);
		}
		catch (AccessDeniedException accessDeniedException) {
			publishEvent(new AuthorizationFailureEvent(object, attributes, authenticated,accessDeniedException));

			throw accessDeniedException;
		}

		...
	}
複製程式碼

authenticated就是當前認證的Authentication，那麼object 和attributes又是什麼呢？

attributes和object 是什麼？

Collection<ConfigAttribute> attributes = this.obtainSecurityMetadataSource()
				.getAttributes(object);
複製程式碼

除錯

我們發現object為當前請求的 url:/persons, 那麼getAttributes方法就是使用當前的訪問資源路徑去匹配我們自己定義的匹配規則。

protected void configure(HttpSecurity http) throws Exception {
        http.formLogin()//使用表單登入，不再使用預設httpBasic方式
                .loginPage(SecurityConstants.DEFAULT_UNAUTHENTICATION_URL)//如果請求的URL需要認證則跳轉的URL
                .loginProcessingUrl(SecurityConstants.DEFAULT_SIGN_IN_PROCESSING_URL_FORM)//處理表單中自定義的登入URL
                .and()
                .authorizeRequests().antMatchers(SecurityConstants.DEFAULT_UNAUTHENTICATION_URL,
                SecurityConstants.DEFAULT_SIGN_IN_PROCESSING_URL_FORM,
                SecurityConstants.DEFAULT_REGISTER_URL,
                "/**/*.js",
                "/**/*.css",
                "/**/*.jpg",
                "/**/*.png",
                "/**/*.woff2")
                .permitAll()//以上的請求都不需要認證
                .anyRequest()//剩下的請求
                .authenticated()//都需要認證
                .and()
                .csrf().disable()//關閉csrd攔截
        ;
    }
複製程式碼

0-7返回 permitALL即不需要認證 ,8對應anyRequest返回 authenticated即當前請求需要認證;

可以看到當前的authenticated為匿名AnonymousAuthentication使用者名稱為anonymousUser

AccessDecisionManager 是如何授權的？

Spring Security預設使用AffirmativeBased實現 AccessDecisionManager 的 decide 方法來實現授權

public void decide(Authentication authentication, Object object,
			Collection<ConfigAttribute> configAttributes) throws AccessDeniedException {
		int deny = 0;
		#1.呼叫AccessDecisionVoter 進行vote(投票)
		for (AccessDecisionVoter voter : getDecisionVoters()) {
			int result = voter.vote(authentication, object, configAttributes);

			if (logger.isDebugEnabled()) {
				logger.debug("Voter: " + voter + ", returned: " + result);
			}

			switch (result) {
			#1.1只要有voter投票為ACCESS_GRANTED，則通過 直接返回
			case AccessDecisionVoter.ACCESS_GRANTED://1
				return;
			@#1.2只要有voter投票為ACCESS_DENIED，則記錄一下
			case AccessDecisionVoter.ACCESS_DENIED://-1
				deny++;

				break;

			default:
				break;
			}
		}

		if (deny > 0) {
		#2.如果有兩個及以上AccessDecisionVoter(姑且稱之為投票者吧)都投ACCESS_DENIED，則直接就不通過了
			throw new AccessDeniedException(messages.getMessage(
					"AbstractAccessDecisionManager.accessDenied", "Access is denied"));
		}

		// To get this far, every AccessDecisionVoter abstained
		checkAllowIfAllAbstainDecisions();
	}
複製程式碼

呼叫AccessDecisionVoter 進行vote(投票)
只要有投通過（ACCESS_GRANTED）票，則直接判為通過。
如果沒有投通過則 deny++ ,最後判斷if（deny>0 丟擲AccessDeniedException（未授權）

WebExpressionVoter.vote()

public int vote(Authentication authentication, FilterInvocation fi,
			Collection<ConfigAttribute> attributes) {
		assert authentication != null;
		assert fi != null;
		assert attributes != null;

		WebExpressionConfigAttribute weca = findConfigAttribute(attributes);

		if (weca == null) {
			return ACCESS_ABSTAIN;
		}

		EvaluationContext ctx = expressionHandler.createEvaluationContext(authentication,
				fi);
		ctx = weca.postProcess(ctx, fi);

		return ExpressionUtils.evaluateAsBoolean(weca.getAuthorizeExpression(), ctx) ? ACCESS_GRANTED
				: ACCESS_DENIED;
	}
複製程式碼

到此位置authentication當前使用者資訊，fl當前訪問的資源路徑及attributes當前資源路徑的決策（即是否需要認證）。剩下就是判斷當前使用者的角色Authentication.authorites是否許可權訪問決策訪問當前資源fi。

時序圖

文章來源`

Spring Security原始碼分析二：Spring Security授權過程
2018-01-05
Spring原始碼
Spring security(五)-完美許可權管理系統（授權過程分析）
2019-07-10
Spring
Spring Security系列之認證過程(六)
2018-12-19
Spring
【認證與授權】Spring Security系列之認證流程解析
2020-04-27
Spring
【認證與授權】Spring Security的授權流程
2020-04-28
Spring
spring security oauth2 password授權模式
2017-12-03
SpringOAuth模式
Spring Cloud Security OAuth2.0 認證授權系列（一）基礎概念
2020-11-23
SpringCloudOAuth
Spring Security方法級別授權使用介紹
2019-05-29
Spring
Spring Security中實現微信網頁授權
2021-08-15
Spring網頁
深入理解Spring Security授權機制原理
2020-12-24
Spring
使用Spring Security OAuth 實現OAuth 2.0 授權
2018-01-12
SpringOAuth
微信小程式授權過程
2020-10-09
微信小程式
Spring Security OAuth2.0認證授權四：分散式系統認證授權
2021-01-14
SpringOAuth分散式
Spring Security原始碼分析一：Spring Security認證過程
2018-01-03
Spring原始碼
Spring Security系列之退出(十三)
2018-12-26
Spring
Spring security（三）---認證過程
2021-09-09
Spring
Spring Security 啟動過程分析
2021-09-09
Spring
spring security 授權方式(自定義)及原始碼跟蹤
2021-12-02
Spring原始碼
Spring Security系列之核心過濾器原始碼分析(四)
2018-12-12
Spring過濾器原始碼
Spring Security系列之Session管理(十四)
2018-12-27
SpringSession
Spring Security OAuth2.0認證授權三：使用JWT令牌
2021-01-11
SpringOAuthJWT
Spring Security OAuth2.0認證授權六：前後端分離下的登入授權
2021-01-29
SpringOAuth後端
Spring Security系列之記住我(十二)
2018-12-24
Spring
原創：oracle 授權的詳細過程
2011-09-01
Oracle
Spring Security原始碼分析七：Spring Security 記住我
2018-01-18
Spring原始碼
專欄丨Spring Security系列教程之Spring Security的四種許可權控制方式
2021-11-05
Spring
Spring Security OAuth2.0認證授權二：搭建資源服務
2021-01-11
SpringOAuth
Spring Security如何優雅的增加OAuth2協議授權模式
2020-09-02
SpringOAuth協議模式
Spring Security系列之入門應用(二)
2018-12-10
Spring
認證授權方案之授權初識
2020-06-28
Spring Security系列之體系結構概述(一)
2018-12-10
Spring
java儲存過程呼叫servlet的授權問題
2007-09-12
Java儲存過程Servlet
基於.NetCore3.1系列 —— 認證授權方案之授權揭祕 (下篇)
2020-07-09
NetCore
Spring Boot Security OAuth2 實現支援JWT令牌的授權伺服器
2019-05-31
Spring BootOAuthJWT伺服器
Spring Security 實戰乾貨：客戶端OAuth2授權請求的
2021-09-09
Spring客戶端OAuth
認證授權方案之授權揭祕 (上篇)
2020-07-05
認證授權：一鍵登入的背後過程
2020-08-16
匯出db裡user的建立和授權的過程
2007-11-20

Spring Security系列之授權過程(七)

前言

類圖

除錯過程

原始碼分析

UsernamePasswordAuthenticationFilter

AbstractAuthenticationProcessingFilter

UsernamePasswordAuthenticationFilter

AnonymousAuthenticationFilter

ExceptionTranslationFilter

FilterSecurityInterceptor

AccessDecisionManager: beforeInvocation

attributes和object 是什麼？

AccessDecisionManager 是如何授權的？

WebExpressionVoter.vote()

時序圖

相關文章