public interface AuthenticationManager {
  Authentication authenticate(Authentication authentication)
    throws AuthenticationException;
}

 An AuthenticationManager can do one of 3 things in its authenticate()method:

AuthenticationManager可以在authenticate（）方法中执行以下三种操作之一：

1、return an Authentication (normally with authenticated=true) if it can verify that the input represents a valid principal.

1、如果它可以验证输入是否代表有效的主体，则返回身份验证（通常使用authenticated = true）。

public interface AuthenticationProvider {

	Authentication authenticate(Authentication authentication)
			throws AuthenticationException;

	boolean supports(Class<?> authentication);

}

supports（）方法中的Class <？>参数实际上是Class <？扩展身份验证>（只会询问它是否支持将传递给authenticate（）方法的内容）。通过委派给AuthenticationProviders链，ProviderManager可以在同一个应用程序中支持多种不同的身份验证机制。如果ProviderManager无法识别特定的身份验证实例类型，则会跳过它。

A ProviderManager has an optional parent, which it can consult if all providers return null. If the parent is not available then a null Authentication results in an AuthenticationException.

Sometimes an application has logical groups of protected resources (e.g. all web resources that match a path pattern /api/**), and each group can have its own dedicated AuthenticationManager. Often, each of those is a ProviderManager, and they share a parent. The parent is then a kind of "global" resource, acting as a fallback for all providers.

 

Figure 1. An AuthenticationManager hierarchy using ProviderManager

图1.使用ProviderManager的AuthenticationManager层次结构

 

Customizing Authentication Managers（自定义身份验证管理器）

Spring Security provides some configuration helpers to quickly get common authentication manager features set up in your application. The most commonly used helper is the AuthenticationManagerBuilder which is great for setting up in-memory, JDBC or LDAP user details, or for adding a custom UserDetailsService. Here’s an example of an application configuring the global (parent) 

Spring Security提供了一些配置帮助程序，可以快速获取应用程序中设置的常见身份验证管理器功能。最常用的帮助程序是AuthenticationManagerBuilder，它非常适合设置内存，JDBC或LDAP用户详细信息，或者用于添加自定义UserDetailsS??ervice。这是配置全局（父）的应用程序的示例

 

@Configuration
public class ApplicationSecurity extends WebSecurityConfigurerAdapter {

   ... // web stuff here

  @Autowired
  public initialize(AuthenticationManagerBuilder builder, DataSource dataSource) {
    builder.jdbcAuthentication().dataSource(dataSource).withUser("dave")
      .password("secret").roles("USER");
  }

}

　　

This example relates to a web application, but the usage of AuthenticationManagerBuilder is more widely applicable (see below for more detail on how web application security is implemented). Note that the AuthenticationManagerBuilder is @Autowired into a method in a @Bean - that is what makes it build the global (parent) AuthenticationManager. In contrast if we had done it this way:

此示例涉及Web应用程序，但AuthenticationManagerBuilder的使用范围更广泛（有关如何实现Web应用程序安全性的更多详细信息，请参阅下文）。请注意，AuthenticationManagerBuilder是@Autowired到@Bean中的方法 - 这使得它构建全局（父）AuthenticationManager。相反，如果我们这样做：

 

@Configuration
public class ApplicationSecurity extends WebSecurityConfigurerAdapter {

  @Autowired
  DataSource dataSource;

   ... // web stuff here

  @Override
  public configure(AuthenticationManagerBuilder builder) {
    builder.jdbcAuthentication().dataSource(dataSource).withUser("dave")
      .password("secret").roles("USER");
  }

}

(using an @Override of a method in the configurer) then the AuthenticationManagerBuilder is only used to build a "local" AuthenticationManager, which is a child of the global one. In a Spring Boot application you can @Autowired the global one into another bean, but you can’t do that with the local one unless you explicitly expose it yourself.

（使用配置程序中的方法的@Override），然后AuthenticationManagerBuilder仅用于构建“本地”AuthenticationManager，它是全局的AuthenticationManager。在Spring Boot应用程序中，你可以@Autowired全局的bean到另一个bean，但除非你自己明确地公开它，否则你不能用本地bean。

 

Spring Boot provides a default global AuthenticationManager (with just one user) unless you pre-empt it by providing your own bean of type AuthenticationManager. The default is secure enough on its own for you not to have to worry about it much, unless you actively need a custom global AuthenticationManager. If you do any configuration that builds an AuthenticationManager you can often do it locally to the resources that you are protecting and not worry about the global default.

 

Spring Boot提供了一个默认的全局AuthenticationManager（只有一个用户），除非您通过提供自己的AuthenticationManager类型的bean来抢占它。除非您主动需要自定义全局AuthenticationManager，否则默认设置足够安全，您不必担心它。如果您执行构建AuthenticationManager的任何配置，您通常可以在本地执行您正在保护的资源，而不必担心全局默认值。

 

 

Authorization or Access Control（授权或访问控制）