public class UsernamePasswordAuthenticationFilter extends
		AbstractAuthenticationProcessingFilter {
	...
	public UsernamePasswordAuthenticationFilter() {
		super(new AntPathRequestMatcher("/login", "POST"));
	}
	...
}

public interface Authentication extends Principal, Serializable {
	
	// 该principal具有的权限。AuthorityUtils工具类提供了一些方便的方法。
	Collection<? extends GrantedAuthority> getAuthorities();
	// 证明Principal的身份的证书，比如密码。
	Object getCredentials();
	// authentication request的附加信息，比如ip。
	Object getDetails();
	// 当事人。在username+password模式中为username，在有userDetails之后可以为userDetails。
	Object getPrincipal();
	// 是否已经通过认证。
	boolean isAuthenticated();
	// 设置通过认证。
	void setAuthenticated(boolean isAuthenticated) throws IllegalArgumentException;
}

// 设置
SecurityContextHolder.getContext().setAuthentication(anAuthentication);
// 获取
Authentication existingAuth = SecurityContextHolder.getContext()
				.getAuthentication();

public String getName() {
	if (this.getPrincipal() instanceof UserDetails) {
		return ((UserDetails) this.getPrincipal()).getUsername();
	}
	if (this.getPrincipal() instanceof AuthenticatedPrincipal) {
		return ((AuthenticatedPrincipal) this.getPrincipal()).getName();
	}
	if (this.getPrincipal() instanceof Principal) {
		return ((Principal) this.getPrincipal()).getName();
	}

	return (this.getPrincipal() == null) ? "" : this.getPrincipal().toString();
}

public interface AuthenticationManager {
	Authentication authenticate(Authentication authentication)
			throws AuthenticationException;
}

public class ProviderManager implements AuthenticationManager, MessageSourceAware,
		InitializingBean {
	...

	public ProviderManager(List<AuthenticationProvider> providers) {
		this(providers, null);
	}

	public ProviderManager(List<AuthenticationProvider> providers,
			AuthenticationManager parent) {
		Assert.notNull(providers, "providers list cannot be null");
		this.providers = providers;
		this.parent = parent;
		checkState();
	}

	public Authentication authenticate(Authentication authentication)
			throws AuthenticationException {
		Class<? extends Authentication> toTest = authentication.getClass();
		AuthenticationException lastException = null;
		AuthenticationException parentException = null;
		Authentication result = null;
		Authentication parentResult = null;
		boolean debug = logger.isDebugEnabled();

		for (AuthenticationProvider provider : getProviders()) {
			// #1, 检查是否由该认证部门进行认证`AuthenticationProvider`
			if (!provider.supports(toTest)) {
				continue;
			}

			if (debug) {
				logger.debug("Authentication attempt using "
						+ provider.getClass().getName());
			}

			try {
				// #2, 认证部门进行认证
				result = provider.authenticate(authentication);

				if (result != null) {
					copyDetails(authentication, result);
					// #3，认证通过则不再进行下一个认证部门的认证，否则抛出的异常被捕获，执行下一个认证部门(AuthenticationProvider)
					break;
				}
			}
			catch (AccountStatusException e) {
				prepareException(e, authentication);
				// SEC-546: Avoid polling additional providers if auth failure is due to
				// invalid account status
				throw e;
			}
			catch (InternalAuthenticationServiceException e) {
				prepareException(e, authentication);
				throw e;
			}
			catch (AuthenticationException e) {
				lastException = e;
			}
		}

		if (result == null && parent != null) {
			// Allow the parent to try.
			try {
				result = parentResult = parent.authenticate(authentication);
			}
			catch (ProviderNotFoundException e) {
				// ignore as we will throw below if no other exception occurred prior to
				// calling parent and the parent
				// may throw ProviderNotFound even though a provider in the child already
				// handled the request
			}
			catch (AuthenticationException e) {
				lastException = parentException = e;
			}
		}
		// #4, 如果认证通过，执行认证通过之后的操作
		if (result != null) {
			if (eraseCredentialsAfterAuthentication
					&& (result instanceof CredentialsContainer)) {
				// Authentication is complete. Remove credentials and other secret data
				// from authentication
				((CredentialsContainer) result).eraseCredentials();
			}

			// If the parent AuthenticationManager was attempted and successful than it will publish an AuthenticationSuccessEvent
			// This check prevents a duplicate AuthenticationSuccessEvent if the parent AuthenticationManager already published it
			if (parentResult == null) {
				eventPublisher.publishAuthenticationSuccess(result);
			}
			return result;
		}

		// Parent was null, or didn't authenticate (or throw an exception).
		// #5，如果认证不通过，必然有抛出异常，否则表示没有配置相应的认证部门(AuthenticationProvider)
		if (lastException == null) {
			lastException = new ProviderNotFoundException(messages.getMessage(
					"ProviderManager.providerNotFound",
					new Object[] { toTest.getName() },
					"No AuthenticationProvider found for {0}"));
		}

		// If the parent AuthenticationManager was attempted and failed than it will publish an AbstractAuthenticationFailureEvent
		// This check prevents a duplicate AbstractAuthenticationFailureEvent if the parent AuthenticationManager already published it
		if (parentException == null) {
			prepareException(lastException, authentication);
		}

		throw lastException;
	}
	...
}

public interface AuthenticationProvider {
	// 进行认证
	Authentication authenticate(Authentication authentication)
			throws AuthenticationException;
	// 是否由该AuthenticationProvider进行认证
	boolean supports(Class<?> authentication);
}

// 获取 UserDetails
protected abstract UserDetails retrieveUser(String username,
		UsernamePasswordAuthenticationToken authentication)
		throws AuthenticationException;

protected abstract void additionalAuthenticationChecks(UserDetails userDetails,
		UsernamePasswordAuthenticationToken authentication)
		throws AuthenticationException;

public interface UserDetails extends Serializable {
	
	Collection<? extends GrantedAuthority> getAuthorities();

	String getPassword();
	
	String getUsername();
	// 账号是否过期
	boolean isAccountNonExpired();
	// 账号是否被锁
	boolean isAccountNonLocked();
	// 证书(password)是否过期
	boolean isCredentialsNonExpired();
	// 账号是否可用
	boolean isEnabled();
}

protected Authentication createSuccessAuthentication(Object principal,
		Authentication authentication, UserDetails user) {
	// Ensure we return the original credentials the user supplied,
	// so subsequent attempts are successful even with encoded passwords.
	// Also ensure we return the original getDetails(), so that future
	// authentication events after cache expiry contain the details
	UsernamePasswordAuthenticationToken result = new UsernamePasswordAuthenticationToken(
			principal, authentication.getCredentials(),
			authoritiesMapper.mapAuthorities(user.getAuthorities()));
	result.setDetails(authentication.getDetails());

	return result;
}

public interface UserDetailsService {
	UserDetails loadUserByUsername(String username) throws UsernameNotFoundException;
}

public interface UserDetailsManager extends UserDetailsService {
	void createUser(UserDetails user);

	void updateUser(UserDetails user);

	void deleteUser(String username);

	void changePassword(String oldPassword, String newPassword);

	boolean userExists(String username);
}