From 1965446d6da4b6886b2c6508048dc9b583369d0e Mon Sep 17 00:00:00 2001 From: Rob Winch Date: Thu, 20 Feb 2020 14:54:24 -0600 Subject: [PATCH] Extract Authentication Docs Issue gh-8005 --- .../architecture/authentication.adoc | 18 ++++++++++++++++++ .../servlet/authorization/architecture.adoc | 2 +- 2 files changed, 19 insertions(+), 1 deletion(-) create mode 100644 docs/manual/src/docs/asciidoc/_includes/servlet/authentication/architecture/authentication.adoc diff --git a/docs/manual/src/docs/asciidoc/_includes/servlet/authentication/architecture/authentication.adoc b/docs/manual/src/docs/asciidoc/_includes/servlet/authentication/architecture/authentication.adoc new file mode 100644 index 0000000000..d57c10054f --- /dev/null +++ b/docs/manual/src/docs/asciidoc/_includes/servlet/authentication/architecture/authentication.adoc @@ -0,0 +1,18 @@ +[[servlet-authentication-authentication]] += Authentication + +The {security-api-url}org/springframework/security/core/Authentication.html[`Authentication`] serves two main purposes within Spring Security: + +* An input to `AuthenticationManager` to provide the credentials a user has provided to authenticate. +When used in this scenario, `isAuthenticated()` returns `false`. +* Represents the currently authenticated user. +The current `Authentication` can be obtained from the <>. + +The `Authentication` contains: + +* `principal` - identifies the user. +When authenticating with a username/password this is often an instance of `UserDetails`. +* `credentials` - Often a password. +In many cases this will be cleared after the user is authenticated to ensure it is not leaked. +* `authorities` - the <> are high level permissions the user is granted. +A few examples are roles or scopes. diff --git a/docs/manual/src/docs/asciidoc/_includes/servlet/authorization/architecture.adoc b/docs/manual/src/docs/asciidoc/_includes/servlet/authorization/architecture.adoc index 9a3fe00ee4..52e641094c 100644 --- a/docs/manual/src/docs/asciidoc/_includes/servlet/authorization/architecture.adoc +++ b/docs/manual/src/docs/asciidoc/_includes/servlet/authorization/architecture.adoc @@ -6,7 +6,7 @@ [[authz-authorities]] == Authorities -As we saw in the <>, all `Authentication` implementations store a list of `GrantedAuthority` objects. +<>, discusses how all `Authentication` implementations store a list of `GrantedAuthority` objects. These represent the authorities that have been granted to the principal. the `GrantedAuthority` objects are inserted into the `Authentication` object by the `AuthenticationManager` and are later read by `AccessDecisionManager` s when making authorization decisions.