$$config title: [spring-security] UsernamePasswordAuthenticationFilter 분석 keywords: - IT - ... $$ # 로직 $$uml actor HttpServletRequest as http usecase "UsernamePasswordAuthenticationFilter\n( attemptAuthentication( ) )" as upaf usecase "UsernamePasswordAuthenticationToken" as upat usecase "AuthenticationManager\n( authenticate( ) )" as am usecase "AuthenticationProvider\n( authenticate( ) )" as ap usecase "userDetailsService" as uds database database as db http -right-> upaf : 1. request 전달 upaf -up-> upat : 2. request안에 아이디,비밀번호 줄테니까 Authentication을 만들어주세요 upaf <-- upat : 3. 아이디, 비밀번호 넣었고, 권한은 없고, 인증은 안된채로 Authentication 만들었습니다. upaf -right-> am : 4. Authentication을 가지고 AuthenticationProvider들을 실행시켜주세요 am -right-> ap : 5. Authentication 인증해주세요 ap -right-> uds : 6. username드릴테니까 db에서 유저 찾아주세요 uds --> db : 7. username의 유저가 있나요? uds <-- db : 8. 네 유저객체 드릴께요 ap <-right- uds : 9. userDatails에 유저객체를 담아드릴께요 am <-- ap : 10. 인증완료된 Authentication 반환합니다 upaf <-- am : 11. Authentication 반환 $$ # UsernamePasswordAuthenticationFilter (attemptAuthentication( ) ) (인증을 시도하다) - `HttpServletRequest`와 `HttpServletResponse`로 인증 시도 ```java @Override public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response) throws AuthenticationException { /** * POST인지 확인하고 POST가 아니면 예외처리 */ if (this.postOnly && !request.getMethod().equals("POST")) { throw new AuthenticationServiceException("Authentication method not supported: " + request.getMethod()); } /** * 1. request에서 "username"의 파라미터 추출 * 2. username이 null이라면 "" 대입, 아니면 그대로 * 3. username이 양쪽 공백 없애기 */ String username = obtainUsername(request); username = (username != null) ? username : ""; username = username.trim(); /** * 1. request에서 "password"의 파라미터 추출 * 2. password null이라면 "" 대입, 아니면 그대로 */ String password = obtainPassword(request); password = (password != null) ? password : ""; /** * username, password, authorities, Authenticated을 들고 있는 UsernamePasswordAuthenticationToken을 생성 * 아이디, 비밀번호를 매개변수로 넣어 권한은 없고, 인증여부는 안된채로 토큰을 생성하여 반환함 * authRequest == Authentication */ UsernamePasswordAuthenticationToken authRequest = new UsernamePasswordAuthenticationToken(username, password); /** * WebAuthenticationDetails 메서드를 통해 ip주소와 세션ID가 있는지 확인하고 있으면 세션ID을 얻어와 세부사항(Details)에 저장 */ setDetails(request, authRequest); /** * ProviderManager으로 Authentication(=authRequest) 전달 */ return this.getAuthenticationManager().authenticate(authRequest); } ``` # UsernamePasswordAuthenticationToken - `principal` = `username` - `credentials` = `password` ```java public UsernamePasswordAuthenticationToken(Object principal, Object credentials) { /** * AbstractAuthenticationToken(null)와 같음 * [아래에 정리해둠] */ super(null); /** * UsernamePasswordAuthenticationFilter에서 전달한 username과 password를 저장 */ this.principal = principal; this.credentials = credentials; /** * 인증이 안됨으로 세팅 */ setAuthenticated(false); } ``` ```java public AbstractAuthenticationToken(Collection authorities) { /** * 권한이 없으면 빈 리스트 넣고 return */ if (authorities == null) { this.authorities = AuthorityUtils.NO_AUTHORITIES; return; } /** * 권한을 들여다봐서 null이 있으면 예외처리 */ for (GrantedAuthority a : authorities) { Assert.notNull(a, "Authorities collection cannot contain any null elements"); } /** * 수정 메서드를 주지 않는 리스트로 authorities에 저장 * 권한 저장 */ this.authorities = Collections.unmodifiableList(new ArrayList<>(authorities)); } ``` # WebAuthenticationDetails - request에서 ip, session 얻기 ```java public WebAuthenticationDetails(HttpServletRequest request) { this.remoteAddress = request.getRemoteAddr(); HttpSession session = request.getSession(false); this.sessionId = (session != null) ? session.getId() : null; } ``` # AuthenticationManager[ProviderManager] ( authenticate ( ) ) - `authenticate` : 진짜임을 증명하다 ```java @Override public Authentication authenticate(Authentication authentication) throws AuthenticationException { Class toTest = authentication.getClass(); AuthenticationException lastException = null; AuthenticationException parentException = null; Authentication result = null; Authentication parentResult = null; int currentPosition = 0; int size = this.providers.size(); /** * Authentication provider 순회 */ for (AuthenticationProvider provider : getProviders()) { if (!provider.supports(toTest)) { continue; } if (logger.isTraceEnabled()) { logger.trace(LogMessage.format("Authenticating request with %s (%d/%d)", provider.getClass().getSimpleName(), ++currentPosition, size)); } try { /** * Authentication을 매개변수에 넣어 provider 인증 수행 */ result = provider.authenticate(authentication); if (result != null) { copyDetails(authentication, result); break; } } catch (AccountStatusException | InternalAuthenticationServiceException ex) { prepareException(ex, authentication); // SEC-546: Avoid polling additional providers if auth failure is due to // invalid account status throw ex; } catch (AuthenticationException ex) { lastException = ex; } } if (result != null) { if (this.eraseCredentialsAfterAuthentication && (result instanceof CredentialsContainer)) { // Authentication is complete. Remove credentials and other secret data // from authentication ((CredentialsContainer) result).eraseCredentials(); } // If the parent AuthenticationManager was attempted and successful then it // will publish an AuthenticationSuccessEvent // This check prevents a duplicate AuthenticationSuccessEvent if the parent // AuthenticationManager already published it if (parentResult == null) { this.eventPublisher.publishAuthenticationSuccess(result); } return result; } ``` # AuthenticationProvider[PreAuthenticatedAuthenticationProvider] ( authenticate( ) ) ```java @Override public Authentication authenticate(Authentication authentication) throws AuthenticationException { if (!supports(authentication.getClass())) { return null; } logger.debug(LogMessage.format("PreAuthenticated authentication request: %s", authentication)); if (authentication.getPrincipal() == null) { logger.debug("No pre-authenticated principal found in request."); if (this.throwExceptionWhenTokenRejected) { throw new BadCredentialsException("No pre-authenticated principal found in request."); } return null; } if (authentication.getCredentials() == null) { logger.debug("No pre-authenticated credentials found in request."); if (this.throwExceptionWhenTokenRejected) { throw new BadCredentialsException("No pre-authenticated credentials found in request."); } return null; } /** * userDetailsService에서 아이디로 유저 찾아서 UserDatils 객체로 반환 */ UserDetails userDetails = this.preAuthenticatedUserDetailsService .loadUserDetails((PreAuthenticatedAuthenticationToken) authentication); this.userDetailsChecker.check(userDetails); /** * 인증완료 유저 객체 반환 */ PreAuthenticatedAuthenticationToken result = new PreAuthenticatedAuthenticationToken(userDetails, authentication.getCredentials(), userDetails.getAuthorities()); /** * ip주소와 세션 기존 Authentication에서 PreAuthenticatedAuthenticationToken으로 복사 */ result.setDetails(authentication.getDetails()); /** * Authentication 반환 */ return result; } ``` - UserDetailsByNameServiceWrapper( ) ```java @Override public UserDetails loadUserDetails(T authentication) throws UsernameNotFoundException { return this.userDetailsService.loadUserByUsername(authentication.getName()); } ``` - WithUserDetailsSecurityContextFactory( ) ```java @Override public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException { return this.userDetailsService.findByUsername(username).block(); } ``` > db에서 username가지고 확인하고 유저객체 반환 ```java public UserDetails loadUserDetails(T authentication) throws UsernameNotFoundException { return this.userDetailsService.loadUserByUsername(authentication.getName()); } ``` # UserDetails ```java public interface UserDetails extends Serializable { Collection getAuthorities(); String getPassword(); String getUsername(); boolean isAccountNonExpired(); boolean isAccountNonLocked(); boolean isCredentialsNonExpired(); boolean isEnabled(); } ``` ```java public class User implements UserDetails, CredentialsContainer { private static final long serialVersionUID = SpringSecurityCoreVersion.SERIAL_VERSION_UID; private static final Log logger = LogFactory.getLog(User.class); private String password; private final String username; private final Set authorities; private final boolean accountNonExpired; private final boolean accountNonLocked; private final boolean credentialsNonExpired; private final boolean enabled; public User(String username, String password, Collection authorities) { this(username, password, true, true, true, true, authorities); } public User(String username, String password, boolean enabled, boolean accountNonExpired, boolean credentialsNonExpired, boolean accountNonLocked, Collection authorities) { Assert.isTrue(username != null && !"".equals(username) && password != null, "Cannot pass null or empty values to constructor"); this.username = username; this.password = password; this.enabled = enabled; this.accountNonExpired = accountNonExpired; this.credentialsNonExpired = credentialsNonExpired; this.accountNonLocked = accountNonLocked; this.authorities = Collections.unmodifiableSet(sortAuthorities(authorities)); } @Override public Collection getAuthorities() { return this.authorities; } @Override public String getPassword() { return this.password; } @Override public String getUsername() { return this.username; } @Override public boolean isEnabled() { return this.enabled; } @Override public boolean isAccountNonExpired() { return this.accountNonExpired; } @Override public boolean isAccountNonLocked() { return this.accountNonLocked; } @Override public boolean isCredentialsNonExpired() { return this.credentialsNonExpired; } @Override public void eraseCredentials() { this.password = null; } private static SortedSet sortAuthorities(Collection authorities) { Assert.notNull(authorities, "Cannot pass a null GrantedAuthority collection"); // Ensure array iteration order is predictable (as per // UserDetails.getAuthorities() contract and SEC-717) SortedSet sortedAuthorities = new TreeSet<>(new AuthorityComparator()); for (GrantedAuthority grantedAuthority : authorities) { Assert.notNull(grantedAuthority, "GrantedAuthority list cannot contain any null elements"); sortedAuthorities.add(grantedAuthority); } return sortedAuthorities; } } ``` # PreAuthenticatedAuthenticationToken - 인증완료된 객체 ```java public PreAuthenticatedAuthenticationToken(Object aPrincipal, Object aCredentials, Collection anAuthorities) { super(anAuthorities); this.principal = aPrincipal; this.credentials = aCredentials; setAuthenticated(true); } ```