二、ProviderManager的校验逻辑

public Authentication authenticate(Authentication authentication)
    throws AuthenticationException {
    Class<? extends Authentication> toTest = authentication.getClass();
    AuthenticationException lastException = null;
    AuthenticationException parentException = null;
    Authentication result = null;
    Authentication parentResult = null;
    boolean debug = logger.isDebugEnabled();

    for (AuthenticationProvider provider : getProviders()) {
        //获取Class，判断当前provider是否支持该authentication
        if (!provider.supports(toTest)) {
            continue;
        }
        //如果支持，则调用provider的authenticate方法开始校验
        result = provider.authenticate(authentication);
        
		//将旧的token的details属性拷贝到新的token中。
        if (result != null) {
            copyDetails(authentication,result);
            break;
        }
    }
    //如果上一步的结果为null，调用provider的parent的authenticate方法继续校验。
    if (result == null && parent != null) {
        result = parentResult = parent.authenticate(authentication);
    }

    if (result != null) {
        if (eraseCredentialsAfterAuthentication
            && (result instanceof CredentialsContainer)) {
            //调用eraseCredentials方法擦除凭证信息
            ((CredentialsContainer) result).eraseCredentials();
        }
        if (parentResult == null) {
            //publishAuthenticationSuccess将登录成功的事件进行广播。
            eventPublisher.publishAuthenticationSuccess(result);
        }
        return result;
    }
}
@H_502_55@

public Authentication authenticate(Authentication authentication)
		throws AuthenticationException {
    //从Authenticaiton中提取登录的用户名。
	String username = (authentication.getPrincipal() == null) ? "NONE_PROVIDED"
			: authentication.getName();
    //返回登录对象
	user = retrieveUser(username,(UsernamePasswordAuthenticationToken) authentication);
    //校验user中的各个账户状态属性是否正常
	preAuthenticationChecks.check(user);
    //密码比对
	additionalAuthenticationChecks(user,(UsernamePasswordAuthenticationToken) authentication);
    //密码比对
	postAuthenticationChecks.check(user);
	Object principalToReturn = user;
    //表示是否强制将Authentication中的principal属性设置为字符串
	if (forcePrincipalAsString) {
		principalToReturn = user.getUsername();
	}
    //构建新的UsernamePasswordAuthenticationToken
	return createSuccessAuthentication(principalToReturn,authentication,user);
}
@H_502_55@

public void doFilter(ServletRequest req,ServletResponse res,FilterChain chain)
		throws IOException,ServletException {
	HttpServletRequest request = (HttpServletRequest) req;
	HttpServletResponse response = (HttpServletResponse) res;
	Authentication authResult;
	try {
        //实际触发了上面提到的attemptAuthentication方法
		authResult = attemptAuthentication(request,response);
		if (authResult == null) {
			return;
		}
		sessionStrategy.onAuthentication(authResult,request,response);
	}
    //登录失败
	catch (InternalAuthenticationServiceException Failed) {
		unsuccessfulAuthentication(request,response,Failed);
		return;
	}
	catch (AuthenticationException Failed) {
		unsuccessfulAuthentication(request,Failed);
		return;
	}
	if (continueChainBeforeSuccessfulAuthentication) {
		chain.doFilter(request,response);
	}
    //登录成功
	successfulAuthentication(request,chain,authResult);
}
@H_502_55@

protected void successfulAuthentication(HttpServletRequest request,HttpServletResponse response,FilterChain chain,Authentication authResult)
		throws IOException,ServletException {
    //将登陆成功的用户信息存储在SecurityContextHolder.getContext()中
	SecurityContextHolder.getContext().setAuthentication(authResult);
	rememberMeServices.loginSuccess(request,authResult);
	// Fire event
	if (this.eventPublisher != null) {
		eventPublisher.publishEvent(new InteractiveAuthenticationSuccessEvent(
				authResult,this.getClass()));
	}
    //登录成功的回调方法
	successHandler.onAuthenticationSuccess(request,authResult);
}
@H_502_55@

SecurityContextHolder.getContext().getAuthentication();
@H_502_55@

@GetMapping("/hr/info")
public Hr getCurrentHr(Authentication authentication) {
    return ((Hr) authentication.getPrincipal());
}
@H_502_55@

	
public static final String MODE_THREADLOCAL = "MODE_THREADLOCAL";
public static final String MODE_INHERITABLETHREADLOCAL = "MODE_INHERITABLETHREADLOCAL";
public static final String MODE_GLOBAL = "MODE_GLOBAL";
public static final String SYSTEM_PROPERTY = "spring.security.strategy";
private static String strategyName = System.getProperty(SYSTEM_PROPERTY);

private static void initialize() {
    if (!StringUtils.hasText(strategyName)) {
        // Set default
        strategyName = MODE_THREADLOCAL;
    }
    if (strategyName.equals(MODE_THREADLOCAL)) {
        strategy = new ThreadLocalSecurityContextHolderStrategy();
    }   
}

private static final ThreadLocal<SecurityContext> contextHolder = new ThreadLocal<>();
@H_502_55@

public class SecurityContextPersistenceFilter extends GenericFilterBean {
	public void doFilter(ServletRequest req,FilterChain chain)
			throws IOException,ServletException {
		HttpServletRequest request = (HttpServletRequest) req;
		HttpServletResponse response = (HttpServletResponse) res;
        if (request.getAttribute(FILTER_APPLIED) != null) {
			// 确保这个过滤器只应对一个请求
			chain.doFilter(request,response);
			return;
		}
        //分岔路口之后，表示应对多个请求
		HttpRequestResponseHolder holder = new HttpRequestResponseHolder(request,response);
        //用户信息在 session 中保存的 value。
		SecurityContext contextBeforeChainExecution = repo.loadContext(holder);
		try {
            //将当前用户信息存入上下文
			SecurityContextHolder.setContext(contextBeforeChainExecution);
			chain.doFilter(holder.getRequest(),holder.getResponse());
		}
		finally {
            //收尾工作，获取SecurityContext
			SecurityContext contextAfterChainExecution = SecurityContextHolder
					.getContext();
            //清空SecurityContext
			SecurityContextHolder.clearContext();
            //重新存进session中
			repo.saveContext(contextAfterChainExecution,holder.getRequest(),holder.getResponse());
		}
	}
}
@H_502_55@

http.authorizeRequests()
        .antMatchers("/hello").permitAll()
        .anyRequest().authenticated()
@H_502_55@

@Override
public void configure(WebSecurity web) throws Exception {
 	web.ignoring().antMatchers("/index.html","/img/**","/fonts/**","/favicon.ico");
}
@H_502_55@