Spring-security-一架构框架ComponentServiceFilter分析
想要深入spring security的authentication (身份验证)和access-control(访问权限控制)工作流程,必须清楚spring security的主要技术点包括关键接口、类以及抽象类如何协同工作进行authentication 和access-control的实现。 1.spring security 认证和授权流程常见认证和授权流程可以分成: A user is prompted to log in with a username and password (用户用账密码登录)The system (successfully) verifies that the password is correct for the username(校验密码正确性)The context information for that user is obtained (their list of roles and so on).(获取用户信息context,如权限)A security context is established for the user(为用户创建security context)The user proceeds, potentially to perform some operation which is potentially protected by an access control mechanism which checks the required permissions for the operation against the current security context information.(访问权限控制,是否具有访问权限)1.1 spring security 认证上述前三点为spring security认证验证环节: ...