public class AuthenticationExample {
    
 private static AuthenticationManager am = new SampleAuthenticationManager();
 
 public static void main(String[] args) throws Exception {
  BufferedReader in = new BufferedReader(new InputStreamReader(System.in));
 
  while (true) {
            //模拟输入用户名密码
   System.out.println("Please enter your username:");
   String name = in.readLine();
            
   System.out.println("Please enter your password:");
   String password = in.readLine();
            
   try {
    //根据用户名/密码，生成未认证Authentication
    Authentication request = new UsernamePasswordAuthenticationToken(name, password);
                //交给AuthenticationManager 认证
    Authentication result = am.authenticate(request);
    //将已认证的Authentication放入SecurityContext
    SecurityContextHolder.getContext().setAuthentication(result);
    break;
   } catch (AuthenticationException e) {
    System.out.println("Authentication failed: " + e.getMessage());
   }
  }
        
  System.out.println("Successfully authenticated. Security context contains: "
    + SecurityContextHolder.getContext().getAuthentication());
 }
}

//认证类
class SampleAuthenticationManager implements AuthenticationManager {
    //配置一个简单的用户权限集合
 static final List<GrantedAuthority> AUTHORITIES = new ArrayList<GrantedAuthority>();
 
    static {
  AUTHORITIES.add(new SimpleGrantedAuthority("ROLE_USER"));
 }
 
 public Authentication authenticate(Authentication auth) throws AuthenticationException {
        //如果用户名和密码一致，则登录成功，这里只做了简单认证
  if (auth.getName().equals(auth.getCredentials())) {
   //认证成功，生成已认证Authentication，比未认证多了权限
   return new UsernamePasswordAuthenticationToken(auth.getName(), auth.getCredentials(), AUTHORITIES);
  }
        
  throw new BadCredentialsException("Bad Credentials");
 }
}

requiresAuthentication(request, response)；
authResult = attemptAuthentication(request, response)；
sessionStrategy.onAuthentication(authResult, request, response);
unsuccessfulAuthentication(request, response, failed);
successfulAuthentication(request, response, chain, authResult);

public class UsernamePasswordAuthenticationFilter extends
  AbstractAuthenticationProcessingFilter {
 
 public static final String SPRING_SECURITY_FORM_USERNAME_KEY = "username";
 public static final String SPRING_SECURITY_FORM_PASSWORD_KEY = "password";

 ...
    ...

 // ~ Constructors
 // ===================================================================================================

 public UsernamePasswordAuthenticationFilter() {
  super(new AntPathRequestMatcher("/login", "POST"));
 }

 public Authentication attemptAuthentication(HttpServletRequest request,
   HttpServletResponse response) throws AuthenticationException {
  if (postOnly && !request.getMethod().equals("POST")) {
   throw new AuthenticationServiceException(
     "Authentication method not supported: " + request.getMethod());
  }

  String username = obtainUsername(request);
  String password = obtainPassword(request);

  if (username == null) {
   username = "";
  }

  if (password == null) {
   password = "";
  }

  username = username.trim();

  UsernamePasswordAuthenticationToken authRequest = new UsernamePasswordAuthenticationToken(
    username, password);

  // Allow subclasses to set the "details" property
  setDetails(request, authRequest);

  return this.getAuthenticationManager().authenticate(authRequest);
 }

 @Nullable
 protected String obtainPassword(HttpServletRequest request) {
  return request.getParameter(passwordParameter);
 }

 @Nullable
 protected String obtainUsername(HttpServletRequest request) {
  return request.getParameter(usernameParameter);
 }

 protected void setDetails(HttpServletRequest request,
   UsernamePasswordAuthenticationToken authRequest) {
  authRequest.setDetails(authenticationDetailsSource.buildDetails(request));
 }

 ......其他略......
}

public Authentication authenticate(Authentication authentication)
   throws AuthenticationException {
  ......

  //获取authentication中存储的用户名
  String username = (authentication.getPrincipal() == null) ? "NONE_PROVIDED"
    : authentication.getName();

     //判断是否使用了缓存
  boolean cacheWasUsed = true;
  UserDetails user = this.userCache.getUserFromCache(username);

  if (user == null) {
   cacheWasUsed = false;

   try {
                //retrieveUser()是一个抽象方法，由子类DaoAuthenticationProvider来实现，用于根据用户名查询用户。
    user = retrieveUser(username,
      (UsernamePasswordAuthenticationToken) authentication);
   }
   catch (UsernameNotFoundException notFound) {
    ......
  }

  try {
            //进行必要的认证前和额外认证的检查
   preAuthenticationChecks.check(user);
            
            //这是抽象方法，由子类DaoAuthenticationProvider来实现，用于进行密码对比
   additionalAuthenticationChecks(user,
     (UsernamePasswordAuthenticationToken) authentication);
  }
  catch (AuthenticationException exception) {
   if (cacheWasUsed) {
    //在发生异常时，尝试着从缓存中进行对象的加载
    cacheWasUsed = false;
    user = retrieveUser(username,
      (UsernamePasswordAuthenticationToken) authentication);
    preAuthenticationChecks.check(user);
    additionalAuthenticationChecks(user,
      (UsernamePasswordAuthenticationToken) authentication);
   }
   else {
    throw exception;
   }
  }
  
        //认证后的检查操作
  postAuthenticationChecks.check(user);

  if (!cacheWasUsed) {
   this.userCache.putUserInCache(user);
  }

  Object principalToReturn = user;

  if (forcePrincipalAsString) {
   principalToReturn = user.getUsername();
  }
  
        //认证成功后，封装认证对象
  return createSuccessAuthentication(principalToReturn, authentication, user);
 }

public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain)
   throws IOException, ServletException {

  HttpServletRequest request = (HttpServletRequest) req;
  HttpServletResponse response = (HttpServletResponse) res;

  if (!requiresAuthentication(request, response)) {
   chain.doFilter(request, response);

   return;
  }

  ......

  Authentication authResult;

  try {
   authResult = attemptAuthentication(request, response);
   if (authResult == null) {
    // return immediately as subclass has indicated that it hasn't completed
    // authentication
    return;
   }
   sessionStrategy.onAuthentication(authResult, request, response);
  }
  catch (InternalAuthenticationServiceException failed) {
   logger.error(
     "An internal error occurred while trying to authenticate the user.",
     failed);
   unsuccessfulAuthentication(request, response, failed);

   return;
  }
  catch (AuthenticationException failed) {
   // Authentication failed
   unsuccessfulAuthentication(request, response, failed);

   return;
  }

  // Authentication success
  if (continueChainBeforeSuccessfulAuthentication) {
   chain.doFilter(request, response);
  }

     //处理认证后的操作
  successfulAuthentication(request, response, chain, authResult);
 }