public Authentication attemptAuthentication(HttpServletRequest request,
                                            HttpServletResponse response) throws AuthenticationException {
    if (postOnly && !request.getMethod().equals("POST")) {
        throw new AuthenticationServiceException(
                "Authentication method not supported: " + request.getMethod());
    }
    // 1.获取表单中的用户名和密码
    String username = obtainUsername(request);
    String password = obtainPassword(request);

    if (username == null) {
        username = "";
    }

    if (password == null) {
        password = "";
    }

    username = username.trim();
    // 2.封装为一个对象
    UsernamePasswordAuthenticationToken authRequest = new UsernamePasswordAuthenticationToken(
            username, password);

    // Allow subclasses to set the "details" property
    setDetails(request, authRequest);

    return this.getAuthenticationManager().authenticate(authRequest);
}
`

public class UsernamePasswordAuthenticationToken extends AbstractAuthenticationToken {
    ...
    public UsernamePasswordAuthenticationToken(Object principal, Object credentials) {
        super(null);
        this.principal = principal;
        this.credentials = credentials;
        setAuthenticated(false);
    }
    ...
}

public abstract class AbstractAuthenticationToken implements Authentication,
            CredentialsContainer {
        
        // 权限集合
        private final Collection<GrantedAuthority> authorities;
        private       Object                       details;
        private boolean authenticated = false;
        ...
}

// 认证提供者列表
private List<AuthenticationProvider> providers = Collections.emptyList();

public List<AuthenticationProvider> getProviders() {
    return providers;
}

public Authentication authenticate(Authentication authentication)
        throws AuthenticationException {

    for (AuthenticationProvider provider : getProviders()) {
        if (!provider.supports(toTest)) {
            continue;
        }
        ...

        try {
            // 根据不同的认证提供者进行认证
            result = provider.authenticate(authentication);
            // 只要有一个认证提供者认证成功，就算认证成功，跳出循环
            if (result != null) {
                copyDetails(authentication, result);
                break;
            }
            ...
        } catch {
            ...
        }
    }

    if (result != null) {
        ...
        return result;
    }
}

protected final UserDetails retrieveUser(String username,
                                         UsernamePasswordAuthenticationToken authentication)
        throws AuthenticationException {

    prepareTimingAttackProtection();
    try {
        // 从数据源中根据用户名获取 UserDetails 对象
        UserDetails loadedUser = this.getUserDetailsService().loadUserByUsername(username);
        if (loadedUser == null) {
            throw new InternalAuthenticationServiceException(
                    "UserDetailsService returned null, which is an interface contract violation");
        }
        return loadedUser;
    } catch (){
        ...
    }
}

protected void additionalAuthenticationChecks(UserDetails userDetails,
                                              UsernamePasswordAuthenticationToken authentication)
        throws AuthenticationException {
    if (authentication.getCredentials() == null) {
        // 表单未输密码抛异常
        throw new BadCredentialsException(...);
    }

    String presentedPassword = authentication.getCredentials().toString();

    // 将表单密码加密后与数据源获取的密文进行匹配
    if (!passwordEncoder.matches(presentedPassword, userDetails.getPassword())) {
        // 不匹配抛异常
        throw new BadCredentialsException(...);
    }
}

// 从数据源中根据用户名获取 UserDetails 对象
UserDetails loadedUser = this.getUserDetailsService().loadUserByUsername(username);

public interface UserDetailsService {
    UserDetails loadUserByUsername(String username) throws UsernameNotFoundException;
}

public class InMemoryUserDetailsManager implements UserDetailsManager,
            UserDetailsPasswordService {
        ......
        
        public UserDetails loadUserByUsername(String username)
                throws UsernameNotFoundException {
            UserDetails user = users.get(username.toLowerCase());

            if (user == null) {
                throw new UsernameNotFoundException(username);
            }

            return new User(user.getUsername(), user.getPassword(), user.isEnabled(),
                            user.isAccountNonExpired(), user.isCredentialsNonExpired(),
                            user.isAccountNonLocked(), user.getAuthorities());
        }
        ......
    }

@Service
public class UserServiceImpl implements UserDetailsService {

    @Autowired
    private PasswordEncoder passwordEncoder;

    @Autowired
    private UserMapper userMapper;

    /**
     * Spring Security 认证授权均通过 UserDetailsService 接口提供的 loadUserByUsername 方法，
     * 该方法返回 UserDetails 对象，该对象包含了用户角色权限信息，之后 url 权限校验需要使用
     */
    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        QueryWrapper<User> userWrapper = new QueryWrapper<>();
        userWrapper.eq("username", username);
        User user = userMapper.selectOne(userWrapper);
        if (user == null) {
            throw new UsernameNotFoundException(username);
        }
        Set<String> permissionSet = userMapper.selectPermissionListByUsername(username);

        return new SecurityUser(user.getUsername(), user.getPassword(), permissionSet,
                                true, true, true, true);
    }
}

@EnableWebSecurity 
public class SecurityConfig extends WebSecurityConfigurerAdapter {
        
    ......
        
    @Autowired
    private UserServiceImpl userService;
    
    /**
     * 认证：使用自定义的 UserDetailsService 实现类读取用户信息
     */
    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.userDetailsService(userService);
    }
    ......
}

public interface UserDetails extends Serializable {

    // 权限集合
    Collection<? extends GrantedAuthority> getAuthorities();

    // 获取密码
    String getPassword();

    // 获取用户名
    String getUsername();

    // 帐号未过期
    boolean isAccountNonExpired();

    // 帐号未锁定
    boolean isAccountNonLocked();

    // 凭证未过期
    boolean isCredentialsNonExpired();

    // 帐号可用
    boolean isEnabled();
}

if (!passwordEncoder.matches(presentedPassword, userDetails.getPassword())) {
    logger.debug("Authentication failed: password does not match stored value");

    throw new BadCredentialsException(messages.getMessage(
    "AbstractUserDetailsAuthenticationProvider.badCredentials",
        "Bad credentials"));
}