Spring Security3源码分析-AnonymousAuthenticationFilter分析

AnonymousAuthenticationFilter过滤器对应的类路径为
org.springframework.security.web.authentication.AnonymousAuthenticationFilter
AnonymousAuthenticationFilter过滤器是在UsernamePasswordAuthenticationFilter、BasicAuthenticationFilter、RememberMeAuthenticationFilter这些过滤器后面的，所以如果这三个过滤器都没有认证成功，则为当前的SecurityContext中添加一个经过匿名认证的token，但是通过servlet的getRemoteUser等方法是获取不到登录账号的。因为SecurityContextHolderAwareRequestFilter过滤器在AnonymousAuthenticationFilter前面。

    //省略了日志部分
    public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain)
            throws IOException, ServletException {
        //applyAnonymousForThisRequest永远返回ture
        if (applyAnonymousForThisRequest((HttpServletRequest) req)) {
            //如果当前SecurityContext中没有认证实体
            if (SecurityContextHolder.getContext().getAuthentication() == null) {
                //产生一个匿名认证实体，并保存到SecurityContext中
                SecurityContextHolder.getContext().setAuthentication(createAuthentication((HttpServletRequest) req));
            } else {
            }
        }

        chain.doFilter(req, res);
    }

    protected Authentication createAuthentication(HttpServletRequest request) {
        //产生匿名认证token，注意这里的key、userAttribute是通过解析标签注入的
        AnonymousAuthenticationToken auth = new AnonymousAuthenticationToken(key, userAttribute.getPassword(),
                userAttribute.getAuthorities());
        auth.setDetails(authenticationDetailsSource.buildDetails(request));

        return auth;
    }

anonymous标签配置为。

<anonymous granted-authority="ROLE_ANONYMOUS" enabled="true" username="test"/>

这里username属性容易混淆，username默认为anonymousUser，实际上是注入到UserAttribute的password变量中的。
granted-authority属性注入到UserAttribute的authorities授权列表