SecurityContext context = SecurityContextHolder.createEmptyContext();
// 手動(dòng)生成一個(gè)Authentication,實(shí)際一般是通過數(shù)據(jù)庫(kù)查出來生成的
Authentication authentication =
    new TestingAuthenticationToken("username", "password", "ROLE_USER");
context.setAuthentication(authentication);
SecurityContextHolder.setContext(context);

public class FilterChainProxy extends GenericFilterBean {
	@Override
	public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
			throws IOException, ServletException {
		...
		try {
			...
			// 執(zhí)行Spring Security 的 SecurityFilterChain
			doFilterInternal(request, response, chain);
		}
		catch (Exception ex) {
			...
		}
		finally {
			// ***************
			// 清除ThreadLocal
			// ***************
			SecurityContextHolder.clearContext();
			request.removeAttribute(FILTER_APPLIED);
		}
	}
}

public class SecurityContextHolder {
	// 存儲(chǔ)SecurityContext的模式，默認(rèn) ThreadLocal存儲(chǔ)
	public static final String MODE_THREADLOCAL = "MODE_THREADLOCAL";
	public static final String MODE_INHERITABLETHREADLOCAL = "MODE_INHERITABLETHREADLOCAL";
	public static final String MODE_GLOBAL = "MODE_GLOBAL";
	private static final String MODE_PRE_INITIALIZED = "MODE_PRE_INITIALIZED";
	public static final String SYSTEM_PROPERTY = "spring.security.strategy";
	// 通過系統(tǒng)參數(shù)指定 存儲(chǔ)模式
	private static String strategyName = System.getProperty(SYSTEM_PROPERTY);
	// 實(shí)際存儲(chǔ)SecurityContext的接口（類）
	private static SecurityContextHolderStrategy strategy;
	private static int initializeCount = 0;
	static {
		// 初始化
		initialize();
	}
	private static void initialize() {
		initializeStrategy();
		initializeCount++;
	}
	private static void initializeStrategy() {
		...
		if (!StringUtils.hasText(strategyName)) {
			// Set default 默認(rèn) ThreadLocal
			strategyName = MODE_THREADLOCAL;
		}
		if (strategyName.equals(MODE_THREADLOCAL)) {
			strategy = new ThreadLocalSecurityContextHolderStrategy();
			return;
		}
		...
	}
	// 修改Strategy
	public static void setStrategyName(String strategyName) {
		SecurityContextHolder.strategyName = strategyName;
		initialize();
	}
	// 自定義Strategy
	public static void setContextHolderStrategy(SecurityContextHolderStrategy strategy) {
		Assert.notNull(strategy, "securityContextHolderStrategy cannot be null");
		SecurityContextHolder.strategyName = MODE_PRE_INITIALIZED;
		SecurityContextHolder.strategy = strategy;
		initialize();
	}
	public static SecurityContext getContext() {
		return strategy.getContext();
	}
	public static void setContext(SecurityContext context) {
		strategy.setContext(context);
	}
	public static void clearContext() {
		strategy.clearContext();
	}

final class ThreadLocalSecurityContextHolderStrategy implements SecurityContextHolderStrategy {
	// ThreadLocal
	private static final ThreadLocal<SecurityContext> contextHolder = new ThreadLocal<>();
	@Override
	public void clearContext() {
		contextHolder.remove();
	}
	@Override
	public SecurityContext getContext() {
		SecurityContext ctx = contextHolder.get();
		if (ctx == null) {
			ctx = createEmptyContext();
			contextHolder.set(ctx);
		}
		return ctx;
	}
	@Override
	public void setContext(SecurityContext context) {
		Assert.notNull(context, "Only non-null SecurityContext instances are permitted");
		contextHolder.set(context);
	}
	@Override
	public SecurityContext createEmptyContext() {
		return new SecurityContextImpl();
	}
}

public interface AuthenticationManager {
	// 傳入一個(gè)待認(rèn)證的Authentication
	// 返回 a fully authenticated object including credentials
	Authentication authenticate(Authentication authentication) throws AuthenticationException;
}

/**
 * ProviderManager中的List<AuthenticationProvider>會(huì)按順序認(rèn)證，知道有一個(gè)返回非空。
 * 如果后面的 AuthenticationProvider返回非空認(rèn)證結(jié)果，前面拋出的異常統(tǒng)統(tǒng)清除；如果后面還有異常，以第一個(gè)異常為準(zhǔn)
 * 
 * 該類中有一個(gè) parent 的字段，類型也為AuthenticationManager，
 * 如果該類中的List<AuthenticationProvider>都不能認(rèn)證，會(huì)調(diào)用parent認(rèn)證，這個(gè)不常用。
 * 
 * 事件發(fā)布：
 * ProviderManager中認(rèn)證事件發(fā)布委托給 AuthenticationEventPublisher 實(shí)現(xiàn)，默認(rèn)是空實(shí)現(xiàn)。
 * parent 的 ProviderManager中不要實(shí)現(xiàn) Publisher，否則會(huì)重復(fù)發(fā)布。
 **/
public class ProviderManager implements AuthenticationManager, MessageSourceAware, InitializingBean {
	// 事件發(fā)布，默認(rèn)空實(shí)現(xiàn)
	private AuthenticationEventPublisher eventPublisher = new NullEventPublisher();
	// 實(shí)際認(rèn)證的AuthenticationProvider
	private List<AuthenticationProvider> providers = Collections.emptyList();
	// 父級(jí)認(rèn)證Manager
	private AuthenticationManager parent;
	@Override
	public Authentication authenticate(Authentication authentication) throws AuthenticationException {
		for (AuthenticationProvider provider : getProviders()) {
			if (!provider.supports(toTest)) {
				continue;
			}
			...
			result = provider.authenticate(authentication);
			if (result != null) {
				copyDetails(authentication, result);
				break;
			}
			...
		}
		// 該類中AuthenticationManager都判斷完了，結(jié)果還是空，調(diào)用parent開始認(rèn)證
		if (result == null && this.parent != null) {
			// Allow the parent to try.
			parentResult = this.parent.authenticate(authentication);
		}
		...
	// AbstractAuthenticationToken就是Authentication接口的實(shí)現(xiàn)類，模板模式
	// 常用的UsernamePasswordAuthenticationToken和OAuth2AuthenticationToken都extends這個(gè)Abstract類
	private void copyDetails(Authentication source, Authentication dest) {
		if ((dest instanceof AbstractAuthenticationToken) && (dest.getDetails() == null)) {
			AbstractAuthenticationToken token = (AbstractAuthenticationToken) dest;
			token.setDetails(source.getDetails());
		}
	}
}

public interface AuthenticationProvider {
	Authentication authenticate(Authentication authentication) throws AuthenticationException;
	boolean supports(Class<?> authentication);