spring-boot - Spring Security : what function does AuthenticationManager. authenticate() 执行

Question

我已经使用 JWT 研究 Spring 安全性一段时间了，我注意到在我阅读的每个教程中，用户名和密码都被获取，包装在 UsernamePasswordAuthenticationToken 中并传递给 AuthenticationManager.authenticate() 之类的东西:

@RequestMapping(value = "${jwt.route.authentication.path}", method = RequestMethod.POST)
public ResponseEntity<?> createAuthenticationToken(@RequestBody JwtAuthenticationRequest authenticationRequest) throws AuthenticationException {

    authenticationManager.authenticate(new UsernamePasswordAuthenticationToken(authenticationRequest.getUsername(), authenticationRequest.getPassword()));

    // Reload password post-security so we can generate the token
    final UserDetails userDetails = userDetailsService.loadUserByUsername(authenticationRequest.getUsername());
    final String token = jwtTokenUtil.generateToken(userDetails);

    // Return the token
    return ResponseEntity.ok(new JwtAuthenticationResponse(token));
}

我的问题是 authenticate 方法是做什么的，为什么要使用它？

Answer 1

来自Spring Security Reference :

AuthenticationManager is just an interface, so the implementation can be anything we choose. (...) The default implementation in Spring Security is called ProviderManager and rather than handling the authentication request itself, it delegates to a list of configured AuthenticationProviders, each of which is queried in turn to see if it can perform the authentication. Each provider will either throw an exception or return a fully populated Authentication object.