深入理解SpringSecurity中的Authentication信息与登录流程和过滤器的配置：addFilterBefore

	public Authentication attemptAuthentication(HttpServletRequest request,
			HttpServletResponse response) throws AuthenticationException {
		if (postOnly && !request.getMethod().equals("POST")) {
			throw new AuthenticationServiceException(
					"Authentication method not supported: " + request.getMethod());
		}
		//获取用户名和密码
		String username = obtainUsername(request);
		String password = obtainPassword(request);

		if (username == null) {
			username = "";
		}

		if (password == null) {
			password = "";
		}
		username = username.trim();
		//构造UsernamePasswordAuthenticationToken对象
		UsernamePasswordAuthenticationToken authRequest = new UsernamePasswordAuthenticationToken(
				username, password);

		// 为details属性赋值
		setDetails(request, authRequest);
		// 调用authenticate方法进行校验
		return this.getAuthenticationManager().authenticate(authRequest);
	}

	@Nullable
	protected String obtainPassword(HttpServletRequest request) {
		return request.getParameter(passwordParameter);
	}
	@Nullable
	protected String obtainUsername(HttpServletRequest request) {
		return request.getParameter(usernameParameter);
	}

UsernamePasswordAuthenticationToken authRequest = new UsernamePasswordAuthenticationToken(
    username, password);

//UsernamePasswordAuthenticationToken 的构造器
public UsernamePasswordAuthenticationToken(Object principal, Object credentials) {
    super(null);
    this.principal = principal;
    this.credentials = credentials;
    setAuthenticated(false);
}

// Allow subclasses to set the "details" property 允许子类去设置这个属性
setDetails(request, authRequest);

protected void setDetails(HttpServletRequest request,
                          UsernamePasswordAuthenticationToken authRequest) {
    authRequest.setDetails(authenticationDetailsSource.buildDetails(request));
}

//AbstractAuthenticationToken 是UsernamePasswordAuthenticationToken的父类
public void setDetails(Object details) {
    this.details = details;
}

	public WebAuthenticationDetails(HttpServletRequest request) {
		this.remoteAddress = request.getRemoteAddr();

		HttpSession session = request.getSession(false);
		this.sessionId = (session != null) ? session.getId() : null;
	}

this.getAuthenticationManager().authenticate(authRequest)

public Authentication authenticate(Authentication authentication)
    throws AuthenticationException {
    Class<? extends Authentication> toTest = authentication.getClass();
    AuthenticationException lastException = null;
    AuthenticationException parentException = null;
    Authentication result = null;
    Authentication parentResult = null;
    boolean debug = logger.isDebugEnabled();

    for (AuthenticationProvider provider : getProviders()) {
        //获取Class，判断当前provider是否支持该authentication
        if (!provider.supports(toTest)) {
            continue;
        }
        //如果支持，则调用provider的authenticate方法开始校验
        result = provider.authenticate(authentication);
        
		//将旧的token的details属性拷贝到新的token中。
        if (result != null) {
            copyDetails(authentication, result);
            break;
        }
    }
    //如果上一步的结果为null，调用provider的parent的authenticate方法继续校验。
    if (result == null && parent != null) {
        result = parentResult = parent.authenticate(authentication);
    }

    if (result != null) {
        if (eraseCredentialsAfterAuthentication
            && (result instanceof CredentialsContainer)) {
            //调用eraseCredentials方法擦除凭证信息
            ((CredentialsContainer) result).eraseCredentials();
        }
        if (parentResult == null) {
            //publishAuthenticationSuccess将登录成功的事件进行广播。
            eventPublisher.publishAuthenticationSuccess(result);
        }
        return result;
    }
}

public Authentication authenticate(Authentication authentication)
		throws AuthenticationException {
    //从Authenticaiton中提取登录的用户名。
	String username = (authentication.getPrincipal() == null) ? "NONE_PROVIDED"
			: authentication.getName();
    //返回登录对象
	user = retrieveUser(username,(UsernamePasswordAuthenticationToken) authentication);
    //校验user中的各个账户状态属性是否正常
	preAuthenticationChecks.check(user);
    //密码比对
	additionalAuthenticationChecks(user,(UsernamePasswordAuthenticationToken) authentication);
    //密码比对
	postAuthenticationChecks.check(user);
	Object principalToReturn = user;
    //表示是否强制将Authentication中的principal属性设置为字符串
	if (forcePrincipalAsString) {
		principalToReturn = user.getUsername();
	}
    //构建新的UsernamePasswordAuthenticationToken
	return createSuccessAuthentication(principalToReturn, authentication, user);
}

public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain)
		throws IOException, ServletException {
	HttpServletRequest request = (HttpServletRequest) req;
	HttpServletResponse response = (HttpServletResponse) res;
	Authentication authResult;
	try {
        //实际触发了上面提到的attemptAuthentication方法
		authResult = attemptAuthentication(request, response);
		if (authResult == null) {
			return;
		}
		sessionStrategy.onAuthentication(authResult, request, response);
	}
    //登录失败
	catch (InternalAuthenticationServiceException failed) {
		unsuccessfulAuthentication(request, response, failed);
		return;
	}
	catch (AuthenticationException failed) {
		unsuccessfulAuthentication(request, response, failed);
		return;
	}
	if (continueChainBeforeSuccessfulAuthentication) {
		chain.doFilter(request, response);
	}
    //登录成功
	successfulAuthentication(request, response, chain, authResult);
}

protected void successfulAuthentication(HttpServletRequest request,
		HttpServletResponse response, FilterChain chain, Authentication authResult)
		throws IOException, ServletException {
    //将登陆成功的用户信息存储在SecurityContextHolder.getContext()中
	SecurityContextHolder.getContext().setAuthentication(authResult);
	rememberMeServices.loginSuccess(request, response, authResult);
	// Fire event
	if (this.eventPublisher != null) {
		eventPublisher.publishEvent(new InteractiveAuthenticationSuccessEvent(
				authResult, this.getClass()));
	}
    //登录成功的回调方法
	successHandler.onAuthenticationSuccess(request, response, authResult);
}

SecurityContextHolder.getContext().getAuthentication();

@GetMapping("/hr/info")
public Hr getCurrentHr(Authentication authentication) {
    return ((Hr) authentication.getPrincipal());
}

	
public static final String MODE_THREADLOCAL = "MODE_THREADLOCAL";
public static final String MODE_INHERITABLETHREADLOCAL = "MODE_INHERITABLETHREADLOCAL";
public static final String MODE_GLOBAL = "MODE_GLOBAL";
public static final String SYSTEM_PROPERTY = "spring.security.strategy";
private static String strategyName = System.getProperty(SYSTEM_PROPERTY);

private static void initialize() {
    if (!StringUtils.hasText(strategyName)) {
        // Set default
        strategyName = MODE_THREADLOCAL;
    }
    if (strategyName.equals(MODE_THREADLOCAL)) {
        strategy = new ThreadLocalSecurityContextHolderStrategy();
    }   
}

private static final ThreadLocal<SecurityContext> contextHolder = new ThreadLocal<>();

public class SecurityContextPersistenceFilter extends GenericFilterBean {
	public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain)
			throws IOException, ServletException {
		HttpServletRequest request = (HttpServletRequest) req;
		HttpServletResponse response = (HttpServletResponse) res;
        if (request.getAttribute(FILTER_APPLIED) != null) {
			// 确保这个过滤器只应对一个请求
			chain.doFilter(request, response);
			return;
		}
        //分岔路口之后，表示应对多个请求
		HttpRequestResponseHolder holder = new HttpRequestResponseHolder(request,
				response);
        //用户信息在 session 中保存的 value。
		SecurityContext contextBeforeChainExecution = repo.loadContext(holder);
		try {
            //将当前用户信息存入上下文
			SecurityContextHolder.setContext(contextBeforeChainExecution);
			chain.doFilter(holder.getRequest(), holder.getResponse());
		}
		finally {
            //收尾工作，获取SecurityContext
			SecurityContext contextAfterChainExecution = SecurityContextHolder
					.getContext();
            //清空SecurityContext
			SecurityContextHolder.clearContext();
            //重新存进session中
			repo.saveContext(contextAfterChainExecution, holder.getRequest(),
					holder.getResponse());
		}
	}
}

http.authorizeRequests()
        .antMatchers("/hello").permitAll()
        .anyRequest().authenticated()

@Override
public void configure(WebSecurity web) throws Exception {
 	web.ignoring().antMatchers("/index.html","/img/**","/fonts/**","/favicon.ico");
}

public HttpSecurity addFilterBefore(Filter filter,
                                    Class<? extends Filter> beforeFilter) {
    comparator.registerBefore(filter.getClass(), beforeFilter);
    return addFilter(filter);
}

final class FilterComparator implements Comparator<Filter>, Serializable {
    private static final int INITIAL_ORDER = 100;
    private static final int ORDER_STEP = 100;
    private final Map<String, Integer> filterToOrder = new HashMap<>();

    FilterComparator() { //初始化了一些默认的Filter并规定的order
        Step order = new Step(INITIAL_ORDER, ORDER_STEP);//越往下order越大
        put(ChannelProcessingFilter.class, order.next()); //100
        put(ConcurrentSessionFilter.class, order.next()); //200
        put(WebAsyncManagerIntegrationFilter.class, order.next());
        put(SecurityContextPersistenceFilter.class, order.next());
        put(HeaderWriterFilter.class, order.next());
        put(CorsFilter.class, order.next());
        put(CsrfFilter.class, order.next());
        put(LogoutFilter.class, order.next());
        //...省略
    }

public int compare(Filter lhs, Filter rhs) {
    Integer left = getOrder(lhs.getClass());
    Integer right = getOrder(rhs.getClass());
    return left - right;
}

public void registerBefore(Class<? extends Filter> filter,
                           Class<? extends Filter> beforeFilter) {
    Integer position = getOrder(beforeFilter);//得到要加入的filter的位置
    if (position == null) {}
    put(filter, position - 1);//将当的filter存入map
}

public HttpSecurity addFilter(Filter filter) {
    Class<? extends Filter> filterClass = filter.getClass();
    if (!comparator.isRegistered(filterClass)) {}
    this.filters.add(filter);//向List<Filter> 中加入filter
    return this;
}