认证事件

DeepSeek V3 中英对照 Authentication Events

每当认证成功或失败时，系统会分别触发 AuthenticationSuccessEvent 或 AuthenticationFailureEvent 事件。

要监听这些事件，首先需要发布一个 AuthenticationEventPublisher。Spring Security 提供的 DefaultAuthenticationEventPublisher 非常适合此用途：

Java

@Bean
public AuthenticationEventPublisher authenticationEventPublisher
        (ApplicationEventPublisher applicationEventPublisher) {
    return new DefaultAuthenticationEventPublisher(applicationEventPublisher);
}

Kotlin

@Bean
fun authenticationEventPublisher
        (applicationEventPublisher: ApplicationEventPublisher?): AuthenticationEventPublisher {
    return DefaultAuthenticationEventPublisher(applicationEventPublisher)
}

然后，你可以使用 Spring 的 @EventListener 支持：

Java

@Component
public class AuthenticationEvents {
	@EventListener
    public void onSuccess(AuthenticationSuccessEvent success) {
		// ...
    }

    @EventListener
    public void onFailure(AbstractAuthenticationFailureEvent failures) {
		// ...
    }
}

Kotlin

@Component
class AuthenticationEvents {
    @EventListener
    fun onSuccess(success: AuthenticationSuccessEvent?) {
        // ...
    }

    @EventListener
    fun onFailure(failures: AbstractAuthenticationFailureEvent?) {
        // ...
    }
}

虽然与AuthenticationSuccessHandler和AuthenticationFailureHandler类似，但这些组件的优势在于它们可以独立于servlet API使用。

添加异常映射

默认情况下，DefaultAuthenticationEventPublisher 会为以下事件发布 AuthenticationFailureEvent：

异常类型	对应事件
BadCredentialsException	AuthenticationFailureBadCredentialsEvent
UsernameNotFoundException	AuthenticationFailureBadCredentialsEvent
AccountExpiredException	AuthenticationFailureExpiredEvent
ProviderNotFoundException	AuthenticationFailureProviderNotFoundEvent
DisabledException	AuthenticationFailureDisabledEvent
LockedException	AuthenticationFailureLockedEvent
AuthenticationServiceException	AuthenticationFailureServiceExceptionEvent
CredentialsExpiredException	AuthenticationFailureCredentialsExpiredEvent
InvalidBearerTokenException	AuthenticationFailureBadCredentialsEvent

发布者进行精确的 Exception 匹配，这意味着这些异常的子类不会产生事件。

为此，您可以通过 setAdditionalExceptionMappings 方法向发布者提供额外的映射关系：

Java

@Bean
public AuthenticationEventPublisher authenticationEventPublisher
        (ApplicationEventPublisher applicationEventPublisher) {
    Map<Class<? extends AuthenticationException>,
        Class<? extends AbstractAuthenticationFailureEvent>> mapping =
            Collections.singletonMap(FooException.class, FooEvent.class);
    DefaultAuthenticationEventPublisher authenticationEventPublisher =
        new DefaultAuthenticationEventPublisher(applicationEventPublisher);
    authenticationEventPublisher.setAdditionalExceptionMappings(mapping);
    return authenticationEventPublisher;
}

Kotlin

@Bean
fun authenticationEventPublisher
        (applicationEventPublisher: ApplicationEventPublisher?): AuthenticationEventPublisher {
    val mapping: Map<Class<out AuthenticationException>, Class<out AbstractAuthenticationFailureEvent>> =
            mapOf(Pair(FooException::class.java, FooEvent::class.java))
    val authenticationEventPublisher = DefaultAuthenticationEventPublisher(applicationEventPublisher)
    authenticationEventPublisher.setAdditionalExceptionMappings(mapping)
    return authenticationEventPublisher
}

默认事件

你也可以提供一个捕获所有事件的处理器，以便在任何 AuthenticationException 发生时触发：

Java

@Bean
public AuthenticationEventPublisher authenticationEventPublisher
        (ApplicationEventPublisher applicationEventPublisher) {
    DefaultAuthenticationEventPublisher authenticationEventPublisher =
        new DefaultAuthenticationEventPublisher(applicationEventPublisher);
    authenticationEventPublisher.setDefaultAuthenticationFailureEvent
        (AbstractAuthenticationFailureEvent.class);
    return authenticationEventPublisher;
}

Kotlin

@Bean
fun authenticationEventPublisher
        (applicationEventPublisher: ApplicationEventPublisher?): AuthenticationEventPublisher {
    val authenticationEventPublisher = DefaultAuthenticationEventPublisher(applicationEventPublisher)
    authenticationEventPublisher.setDefaultAuthenticationFailureEvent(AbstractAuthenticationFailureEvent::class.java)
    return authenticationEventPublisher
}