问spring安全手册登录最佳实践

EN

@Component
public class AccountVerificationAuthenticationProvider implements AuthenticationProvider {

    @Autowired
    private AppAuthenticatedUserService appAuthenticatedUserService;

    @Autowired
    private AuthService authService;
    
    @Override
    public Authentication authenticate(Authentication authentication) throws AuthenticationException {

        // This will look in the user's session to get their username, and to make sure the flag is set to allow login without password on this request.
        UserAccount userAccount = authService.getUserAccountFromRecentAccountVerificationProcess();
        if (userAccount == null) {
            // Tell spring we can't process this AuthenticationProvider obj.
            // Spring will continue, and try another AuthenticationProvider, if it can.
            return null;
        }

        // A service to create a custom UserDetails object for this user.
        UserDetails appAuthenticatedUser = appAuthenticatedUserService.create(userAccount.getEmail(), "", true);

        PreAuthenticatedAuthenticationToken authenticationToken = new PreAuthenticatedAuthenticationToken(appAuthenticatedUser, "", appAuthenticatedUser.getAuthorities());
        authenticationToken.setAuthenticated(true);
    
        return authenticationToken;
    }

    @Override
    public boolean supports(Class<?> authentication) {
        return authentication.equals(UsernamePasswordAuthenticationToken.class);
    }

}

// In your WebSecurityConfigurerAdapter
@Configuration
@EnableWebSecurity
public class AppLoginConfig extends WebSecurityConfigurerAdapter {
    @Autowired
    private AccountVerificationAuthenticationProvider accountVerificationAuthenticationProvider;

    @Autowired
    private ActiveDirectoryLdapAuthenticationProvider activeDirectoryLdapAuthenticationProvider;
    
    @Override
    protected void configure(AuthenticationManagerBuilder authenticationManagerBuilder) throws Exception {
        // Spring will try these auth providers in the order we register them.
        // We do the accountVerificationAuthenticationProvider provider first, since it doesn't need to do any slow IO to check,
        // so it's very fast. Only if this AuthenticationProvider  rejects (which means this http request is not for programmatic login), will spring then try the next AuthenticationProvider in the list.
        authenticationManagerBuilder
            .authenticationProvider(accountVerificationAuthenticationProvider)
            // I'm using ActiveDirectory / LDAP for when a user logs in via entering a user + password via the html form, but whatever you want to use here should work.
            .authenticationProvider(activeDirectoryLdapAuthenticationProvider);
    }
    
    @Override
    protected void configure(HttpSecurity httpSecurity) throws Exception {
        ...
    }
}