答

解决方案概述

---

从广义上讲，具有多个AuthenticationProvider的要求分为两类:

Solution overview

---

Broadly speaking, the requirement to have multiple AuthenticationProviders fall into two categories:

1. 使用不同的身份验证模式来身份验证对不同类型URL的请求，例如:

1. Authenticate requests for different types of URLs with different authentication modes, for example:

1. 使用基于表单的用户名密码身份验证来验证所有对/web/**的请求；
2. 使用基于令牌的身份验证对/api/**的所有请求进行身份验证.

1. Authenticate all requests for /web/** using form-based username-password authentication;
2. Authenticate all requests for /api/** using token-based authentication.

使用多种受支持的身份验证模式之一对所有请求进行身份验证.

每种解决方案都略有不同，但是它们基于共同的基础.

The solutions are slightly different for each, but they are based on a common foundation.

Spring Security对基于表单的用户名-密码身份验证提供了开箱即用的支持，因此，无论以上两个类别，都可以轻松实现.

Spring Security has out-of-the-box support for form-based username-password authentication, so regardless of the two categories above, this can be implemented quite easily.

基于令牌的身份验证，因此需要自定义代码才能添加必要的支持.要添加此支持，需要以下组件:

Token-based authentication however, is not supported out-of-the-box, so custom code is required to add the necessary support. The following components are required to add this support:

1. 一个扩展了AbstractAuthenticationToken的POJO，它将保存用于身份验证的令牌.
2. 扩展了AbstractAuthenticationProcessingFilter的过滤器，该过滤器将从请求中提取令牌值并填充在上面的步骤1中创建的POJO.
3. 一个AuthenticationProvider实现，将使用令牌对请求进行身份验证.
4. 上面的选项1或2的Spring Security配置，具体取决于需求.

1. A POJO extending AbstractAuthenticationToken that will hold the token to use for authentication.
2. A filter extending AbstractAuthenticationProcessingFilter that will extract the token value from the request and populate the POJO created on step 1 above.
3. An AuthenticationProvider implementation that will authenticate requests using the token.
4. Spring Security configuration for option 1 or 2 above, depending on the requirement.

AbstractAuthenticationToken

---

需要一个POJO来保存应用于认证请求的JWT令牌，因此，最简单的AbstractAuthenticationToken实现可能类似于:

AbstractAuthenticationToken

---

A POJO is required to hold the JWT token that should be used for authenticating the request, therefore, the simplest AbstractAuthenticationToken implementation could look like:

public JWTAuthenticationToken extends AbstractAuthenticationToken {
  private final String token;

  JWTAuthenticationToken(final String token, final Object details) {
    super(new ArrayList<>());

    this.token = token;

    setAuthenticated(false);
    setDetails(details);
  }

  @Override
  public Object getCredentials() { return null; }

  @Override
  public String getPrincipal() { return token; }
}

AbstractAuthenticationProcessingFilter

---

需要一个过滤器才能从请求中提取令牌.

AbstractAuthenticationProcessingFilter

---

A filter is required to extract the token from the request.

public class JWTTokenAuthenticationFilter extends AbstractAuthenticationProcessingFilter {
  public JWTTokenAuthenticationFilter (String defaultFilterProcessesUrl) {
    super(defaultFilterProcessesUrl);
  }

  @Override
  public Authentication attemptAuthentication(final HttpServletRequest request
  , final HttpServletResponse response)
  throws AuthenticationException {
    final JWTAuthenticationToken token = new JWTAuthenticationToken(/* Get token from request */
    , authenticationDetailsSource.buildDetails(request));

    return getAuthenticationManager().authenticate(token);
  }
}

请注意，过滤器不会尝试执行身份验证；而是将实际的身份验证委派给AuthenticationManager，以确保也可以正确执行任何身份验证之前和之后的步骤.

Notice that the filter does not attempt to perform the authentication; rather, it delegates the actual authentication to an AuthenticationManager, which ensures that any pre and post authentication steps are also performed correctly.

AuthenticationProvider是负责执行身份验证的实际组件.如果配置正确，它会由AuthenticationManager自动调用.一个简单的实现如下所示:

The AuthenticationProvider is the actual component responsible for performing the authentication. It is called by the AuthenticationManager automatically, if configured properly. A simple implementation would look like:

public class JWTAuthenticationProvider implements AuthenticationProvider {
  @Override
  public boolean supports(final Class<?> authentication) {
    return (JWTAuthenticationToken.class.isAssignableFrom(authentication));
  }

  @Override
  public Authentication authenticate(final Authentication authentication)
         throws AuthenticationException {
    final JWTAuthenticationToken token = (JWTAuthenticationToken) authentication;
    ...
  }
}

针对不同URL的不同身份验证模式的Spring Security配置

---

为每个URL系列使用不同的http元素，例如:

Spring Security configuration for different authentication modes for different URLs

---

Use different http elements for each of the URL families, such as:

<bean class="com.domain.path.to.provider.FormAuthenticationProvider" "formAuthenticationProvider" />
<bean class="com.domain.path.to.provider.JWTAuthenticationProvider" "jwtAuthenticationProvider" />

<authentication-manager id="apiAuthenticationManager">
  <authentication-provider ref="jwtAuthenticationProvider" />
</authentication-manager>

<authentication-manager id="formAuthenticationManager">
  <authentication-provider ref="formAuthenticationProvider" />
</authentication-manager>

<bean class="com.domain.path.to.filter.JWTAuthenticationFilter" id="jwtAuthenticationFilter">
  <property name="authenticationManager" ref="apiAuthenticationManager" />
</bean>

<http pattern="/api/**" authentication-manager-red="apiAuthenticationManager">
  <security:custom-filter position="FORM_LOGIN_FILTER" ref="jwtAuthenticationFilter"/>

  ...
</http>

<http pattern="/web/**" authentication-manager-red="formAuthenticationManager">
  ...
</http>

由于不同的URL家族要求使用不同的身份验证模式，因此我们需要两个不同的AuthenticationManager和两个不同的http配置，每个URL家族一个.对于每一种，我们选择支持哪种身份验证模式.

Since different authentication modes are required for different URL families, we need two different AuthenticationManagers and two different http configurations, one for each of the URL families. For each, we choose which mode of authentication is supported.

使用单个http元素，如下所示:

Use a single http element, as follows:

<bean class="com.domain.path.to.provider.FormAuthenticationProvider" "formAuthenticationProvider" />
<bean class="com.domain.path.to.provider.JWTAuthenticationProvider" "jwtAuthenticationProvider" />

<authentication-manager id="authenticationManager">
  <authentication-provider ref="formAuthenticationProvider" />
  <authentication-provider ref="jwtAuthenticationProvider" />
</authentication-manager>

<bean class="com.domain.path.to.filter.JWTAuthenticationFilter" id="jwtAuthenticationFilter">
  <property name="authenticationManager" ref="authenticationManager" />
</bean>

<http pattern="/**">
  <security:custom-filter after="FORM_LOGIN_FILTER" ref="jwtAuthenticationFilter"/>

  ...
</http>

请注意以下几点:

无需为http元素明确指定
1. AuthenticationManager，因为配置中只有一个，并且其标识符为authenticationManager，这是默认值.
2. 将令牌过滤器插入表单登录过滤器后 ，而不是替换它.这样可以确保表单登录和令牌登录都能正常工作.
3. AuthenticationManager被配置为使用多个AuthenticationProvider.这样可以确保尝试多种身份验证机制，直到找到一种支持该请求的机制为止.

1. AuthenticationManager need not be explicitly specified for the http element as there is only one in the configuration and its identifier is authenticationManager, which is the default value.
2. The token filter is inserted after the form login filter, instead of replacing it. This ensures that both form login and token login will work.
3. The AuthenticationManager is configured to use multiple AuthenticationProviders. This ensures that multiple authentication mechanisms are tried, until one is found that is supported for a request.