頂層接口
-
org.springframework.security.config.annotation.ObjectPostProcessor
在SecurityBuilder的抽象實(shí)現(xiàn)AbstractConfiguredSecurityBuilder中被引入。
并且通過構(gòu)造函數(shù)入?yún)⒈辉O(shè)置并且構(gòu)造函數(shù)為protected只能被子類實(shí)例化根暑。
protected AbstractConfiguredSecurityBuilder(
ObjectPostProcessor<Object> objectPostProcessor) {
this(objectPostProcessor, false);
}
protected AbstractConfiguredSecurityBuilder(
ObjectPostProcessor<Object> objectPostProcessor,
boolean allowConfigurersOfSameType) {
Assert.notNull(objectPostProcessor, "objectPostProcessor cannot be null");
this.objectPostProcessor = objectPostProcessor;
this.allowConfigurersOfSameType = allowConfigurersOfSameType;
}
- ObjectPostProcessor
public interface ObjectPostProcessor<T> {
//僅有一個(gè)方法用于初始化修改后的返回修改后的對(duì)象呀打，我們來看看它的具體實(shí)現(xiàn)
<O extends T> O postProcess(O object);
}
- AutowireBeanFactoryObjectPostProcessor
//此類被final修飾，無法繼承劣砍，并且此處實(shí)現(xiàn)了SmartInitializingSingleton該接口
//需實(shí)現(xiàn)afterSingletonsInstantiated，可以對(duì)bean初始化時(shí)做一些其它的事情扇救。
//并實(shí)現(xiàn)了DisposableBean刑枝，即銷毀時(shí)需要自己處理。
final class AutowireBeanFactoryObjectPostProcessor
implements ObjectPostProcessor<Object>, DisposableBean, SmartInitializingSingleton {
private final Log logger = LogFactory.getLog(getClass());
//通過此接口擴(kuò)展使Spring框架之外的程序迅腔，具有自動(dòng)裝配的功能装畅。
private final AutowireCapableBeanFactory autowireBeanFactory;
private final List<DisposableBean> disposableBeans = new ArrayList<>();
private final List<SmartInitializingSingleton> smartSingletons = new ArrayList<>();
public AutowireBeanFactoryObjectPostProcessor(
AutowireCapableBeanFactory autowireBeanFactory) {
Assert.notNull(autowireBeanFactory, "autowireBeanFactory cannot be null");
this.autowireBeanFactory = autowireBeanFactory;
}
//ObjectPostProcessor接口的方法實(shí)現(xiàn)。
@SuppressWarnings("unchecked")
public <T> T postProcess(T object) {
if (object == null) {
return null;
}
T result = null;
try {
//通過AutowireCapableBeanFactory 的初始化方法將對(duì)象交給spring 管理
result = (T) this.autowireBeanFactory.initializeBean(object,
object.toString());
}
catch (RuntimeException e) {
Class<?> type = object.getClass();
throw new RuntimeException(
"Could not postProcess " + object + " of type " + type, e);
}
//通過調(diào)用給定Bean的after-instantiation及post-processing接口沧烈，對(duì)bean進(jìn)行配置
this.autowireBeanFactory.autowireBean(object);
//判斷當(dāng)前bean是否實(shí)現(xiàn)DisposableBean 接口如果實(shí)現(xiàn)就加入disposableBeans容器備用
if (result instanceof DisposableBean) {
this.disposableBeans.add((DisposableBean) result);
}
//同上
if (result instanceof SmartInitializingSingleton) {
this.smartSingletons.add((SmartInitializingSingleton) result);
}
return result;
}
//單例實(shí)例化之后處理掠兄，即傳入的對(duì)象需要實(shí)現(xiàn)afterSingletonsInstantiated接口
//處理在postProcess階段存入smartSingletons的實(shí)例
@Override
public void afterSingletonsInstantiated() {
for (SmartInitializingSingleton singleton : smartSingletons) {
singleton.afterSingletonsInstantiated();
}
}
//銷毀之前存入disposableBeans的需銷毀對(duì)象
public void destroy() throws Exception {
for (DisposableBean disposable : this.disposableBeans) {
try {
disposable.destroy();
}
catch (Exception error) {
this.logger.error(error);
}
}
}
}
以上對(duì)象使用@Bean方式配置，在ObjectPostProcessorConfiguration中注入了
@Configuration
public class ObjectPostProcessorConfiguration {
@Bean
public ObjectPostProcessor<Object> objectPostProcessor(
AutowireCapableBeanFactory beanFactory) {
return new AutowireBeanFactoryObjectPostProcessor(beanFactory);
}
}
ObjectPostProcessorConfiguration 在 AuthenticationConfiguration時(shí)被@Import進(jìn)來。
@Import(ObjectPostProcessorConfiguration.class)
public class AuthenticationConfiguration
而 AuthenticationConfiguration則是通過@EnableGlobalAuthentication 注解導(dǎo)入蚂夕，這個(gè)注解又是被@EnableWebSecurity 注解導(dǎo)入迅诬。
@Retention(value = java.lang.annotation.RetentionPolicy.RUNTIME)
@Target(value = { java.lang.annotation.ElementType.TYPE })
@Documented
@Import({ WebSecurityConfiguration.class,
SpringWebMvcImportSelector.class,
OAuth2ImportSelector.class })
@EnableGlobalAuthentication
@Configuration
public @interface EnableWebSecurity {
接著我們來看它的另一個(gè)實(shí)現(xiàn)CompositeObjectPostProcessor
private static final class CompositeObjectPostProcessor implements
ObjectPostProcessor<Object> {
//定義一個(gè)容器裝ObjectPostProcessor對(duì)象
private List<ObjectPostProcessor<? extends Object>> postProcessors = new ArrayList<ObjectPostProcessor<?>>();
@SuppressWarnings({ "rawtypes", "unchecked" })
public Object postProcess(Object object) {
for (ObjectPostProcessor opp : postProcessors) {
Class<?> oppClass = opp.getClass();
//泛型解析器
Class<?> oppType = GenericTypeResolver.resolveTypeArgument(oppClass,
ObjectPostProcessor.class);
//判斷該泛型對(duì)象是否與傳入對(duì)象相對(duì)應(yīng)如果對(duì)應(yīng)則執(zhí)行該對(duì)象的postProcess方法
if (oppType == null || oppType.isAssignableFrom(object.getClass())) {
object = opp.postProcess(object);
}
}
return object;
}
//往容器中添加ObjectPostProcessor對(duì)象并根據(jù)Ordered注解進(jìn)行排序返回是否添加成功
private boolean addObjectPostProcessor(
ObjectPostProcessor<? extends Object> objectPostProcessor) {
boolean result = this.postProcessors.add(objectPostProcessor);
Collections.sort(postProcessors, AnnotationAwareOrderComparator.INSTANCE);
return result;
}
}
CompositeObjectPostProcessor 是SecurityConfigurerAdapter 的一個(gè)靜態(tài)內(nèi)部類，僅用來返回對(duì)象使用婿牍，這邊是將原對(duì)象傳進(jìn)去侈贷，執(zhí)行對(duì)象的postProcess做一些修改之后在把對(duì)象返回回來。
