spring security @EnableWebSecurity自动配置DaoAuthenticationProvider流程-Toy模板网

这篇具有很好参考价值的文章主要介绍了spring security @EnableWebSecurity自动配置DaoAuthenticationProvider流程。希望对大家有所帮助。如果存在错误或未考虑完全的地方，请大家不吝赐教，您也可以点击"举报违法"按钮提交疑问。

版本

spring-security:6.2.1

满足下列情况时，spring-security会自动配置DaoAuthenticationProvider

使用@EnableWebSecurity
注册UserDetailsServiceBean
没有注册其他AuthenticationProvider类型的Bean
没有通过http.authenticationProvider配置

源码

org.springframework.security.config.annotation.web.configuration.EnableWebSecurity

// 导入全局认证配置
@EnableGlobalAuthentication
public @interface EnableWebSecurity {}

org.springframework.security.config.annotation.authentication.configuration.EnableGlobalAuthentication

// 导入认证配置
@Import(AuthenticationConfiguration.class)
public @interface EnableGlobalAuthentication {}

org.springframework.security.config.annotation.authentication.configuration.AuthenticationConfiguration

public class AuthenticationConfiguration {
	...
	@Bean
	public static InitializeUserDetailsBeanManagerConfigurer initializeUserDetailsBeanManagerConfigurer(
			ApplicationContext context) {
		return new InitializeUserDetailsBeanManagerConfigurer(context);
	}
	...
}

org.springframework.security.config.annotation.authentication.configuration.InitializeUserDetailsBeanManagerConfigurer

@Order(InitializeUserDetailsBeanManagerConfigurer.DEFAULT_ORDER)
class InitializeUserDetailsBeanManagerConfigurer extends GlobalAuthenticationConfigurerAdapter {
	...
	@Override
	public void init(AuthenticationManagerBuilder auth) throws Exception {
		auth.apply(new InitializeUserDetailsManagerConfigurer());
	}
	class InitializeUserDetailsManagerConfigurer extends GlobalAuthenticationConfigurerAdapter {
		@Override
		public void configure(AuthenticationManagerBuilder auth) throws Exception {
			if (auth.isConfigured()) { // 如果认证提供者不为空（通过httpSecurity配置了认证提供者，或者注册了AuthenticationProvider类型的Bean），或者上级的认证管理器不为空则跳过
				return;
			}
			UserDetailsService userDetailsService = getBeanOrNull(UserDetailsService.class);
			if (userDetailsService == null) { // 如果没有注册 UserDetailsService Bean则跳过
				return;
			}
			// 获取密码编码器 Bean
			PasswordEncoder passwordEncoder = getBeanOrNull(PasswordEncoder.class);
			// 获取 UserDetailsPasswordService Bean (用于密码重新编码)
			UserDetailsPasswordService passwordManager = getBeanOrNull(UserDetailsPasswordService.class);
			// 创建并注册 DaoAuthenticationProvider 
			DaoAuthenticationProvider provider = new DaoAuthenticationProvider();
			provider.setUserDetailsService(userDetailsService);
			if (passwordEncoder != null) {
				provider.setPasswordEncoder(passwordEncoder);
			}
			if (passwordManager != null) {
				provider.setUserDetailsPasswordService(passwordManager);
			}
			provider.afterPropertiesSet();
			auth.authenticationProvider(provider);
		}
	}
	...
}

org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder文章来源地址https://www.toymoban.com/news/detail-799480.html

public class AuthenticationManagerBuilder
		extends AbstractConfiguredSecurityBuilder<AuthenticationManager, AuthenticationManagerBuilder>
		implements ProviderManagerBuilder<AuthenticationManagerBuilder> {
		...
		public boolean isConfigured() {
			return !this.authenticationProviders.isEmpty() || this.parentAuthenticationManager != null;
		}
		...
}