SpringSecurityの認証処理を行う流れ

@Bean
public UserDetailsManager userDetailsService(){
    // 既存User : misaka/mikoto
    JdbcUserDetailsManager users = new JdbcUserDetailsManager(this.dataSource);
    return users;
}

@Override
public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response)
		throws AuthenticationException {
	if (this.postOnly && !request.getMethod().equals("POST")) {
		throw new AuthenticationServiceException("Authentication method not supported: " + request.getMethod());
	}
	String username = obtainUsername(request);
	username = (username != null) ? username.trim() : "";
	String password = obtainPassword(request);
	password = (password != null) ? password : "";
	UsernamePasswordAuthenticationToken authRequest = UsernamePasswordAuthenticationToken.unauthenticated(username,
			password);
	// Allow subclasses to set the "details" property
	setDetails(request, authRequest);
	return this.getAuthenticationManager().authenticate(authRequest);
}

@Override
public Authentication authenticate(Authentication authentication) throws AuthenticationException {
	Class<? extends Authentication> toTest = authentication.getClass();
	AuthenticationException lastException = null;
	AuthenticationException parentException = null;
	Authentication result = null;
	Authentication parentResult = null;
	int currentPosition = 0;
	int size = this.providers.size();
	for (AuthenticationProvider provider : getProviders()) {
		if (!provider.supports(toTest)) {
			continue;
		}
		if (logger.isTraceEnabled()) {
			logger.trace(LogMessage.format("Authenticating request with %s (%d/%d)",
					provider.getClass().getSimpleName(), ++currentPosition, size));
		}
		try {
			(1) result = provider.authenticate(authentication);
			if (result != null) {
				copyDetails(authentication, result);
				break;
			}
		}
..........省略
}

@Override
protected final UserDetails retrieveUser(String username, UsernamePasswordAuthenticationToken authentication)
		throws AuthenticationException {
	prepareTimingAttackProtection();
	try {
		UserDetails loadedUser = this.getUserDetailsService().loadUserByUsername(username);
		if (loadedUser == null) {
			throw new InternalAuthenticationServiceException(
					"UserDetailsService returned null, which is an interface contract violation");
		}
		return loadedUser;
	}
...省略
}

@Override
public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
	(1) List<UserDetails> users = loadUsersByUsername(username);
	if (users.size() == 0) {
		this.logger.debug("Query returned no results for user '" + username + "'");
		throw new UsernameNotFoundException(this.messages.getMessage("JdbcDaoImpl.notFound",
				new Object[] { username }, "Username {0} not found"));
	}
	UserDetails user = users.get(0); // contains no GrantedAuthority[]
	Set<GrantedAuthority> dbAuthsSet = new HashSet<>();
	if (this.enableAuthorities) {
		(2) dbAuthsSet.addAll(loadUserAuthorities(user.getUsername()));
	}
	if (this.enableGroups) {
		dbAuthsSet.addAll(loadGroupAuthorities(user.getUsername()));
	}
	List<GrantedAuthority> dbAuths = new ArrayList<>(dbAuthsSet);
	addCustomAuthorities(user.getUsername(), dbAuths);
	if (dbAuths.size() == 0) {
		this.logger.debug("User '" + username + "' has no authorities and will be treated as 'not found'");
		throw new UsernameNotFoundException(this.messages.getMessage("JdbcDaoImpl.noAuthority",
				new Object[] { username }, "User {0} has no GrantedAuthority"));
	}
	(3) return createUserDetails(username, user, dbAuths);
}

protected UserDetails createUserDetails(String username, UserDetails userFromUserQuery,
		List<GrantedAuthority> combinedAuthorities) {
	String returnUsername = userFromUserQuery.getUsername();
	if (!this.usernameBasedPrimaryKey) {
		returnUsername = username;
	}
	return new User(returnUsername, userFromUserQuery.getPassword(), userFromUserQuery.isEnabled(),
			userFromUserQuery.isAccountNonExpired(), userFromUserQuery.isCredentialsNonExpired(),
			userFromUserQuery.isAccountNonLocked(), combinedAuthorities);
}

public static final String DEF_USERS_BY_USERNAME_QUERY = "select username,password,enabled "
			+ "from users "
			+ "where username = ?";

@Override
public Authentication authenticate(Authentication authentication) throws AuthenticationException {
	Assert.isInstanceOf(UsernamePasswordAuthenticationToken.class, authentication,
			() -> this.messages.getMessage("AbstractUserDetailsAuthenticationProvider.onlySupports",
					"Only UsernamePasswordAuthenticationToken is supported"));
	String username = determineUsername(authentication);
	boolean cacheWasUsed = true;
	UserDetails user = this.userCache.getUserFromCache(username);
	if (user == null) {
		cacheWasUsed = false;
		try {
			(1) user = retrieveUser(username, (UsernamePasswordAuthenticationToken) authentication);
		}
		catch (UsernameNotFoundException ex) {
			this.logger.debug("Failed to find user '" + username + "'");
			if (!this.hideUserNotFoundExceptions) {
				throw ex;
			}
			throw new BadCredentialsException(this.messages
					.getMessage("AbstractUserDetailsAuthenticationProvider.badCredentials", "Bad credentials"));
		}
		Assert.notNull(user, "retrieveUser returned null - a violation of the interface contract");
	}
	try {
		this.preAuthenticationChecks.check(user);
		(2) additionalAuthenticationChecks(user, (UsernamePasswordAuthenticationToken) authentication);
	}
.....省略
	return (3) createSuccessAuthentication(principalToReturn, authentication, user);
}

@Override
@SuppressWarnings("deprecation")
protected void additionalAuthenticationChecks(UserDetails userDetails,
		UsernamePasswordAuthenticationToken authentication) throws AuthenticationException {
	if (authentication.getCredentials() == null) {
		this.logger.debug("Failed to authenticate since no credentials provided");
		throw new BadCredentialsException(this.messages
				.getMessage("AbstractUserDetailsAuthenticationProvider.badCredentials", "Bad credentials"));
	}
	String presentedPassword = authentication.getCredentials().toString();
	if (!this.passwordEncoder.matches(presentedPassword, userDetails.getPassword())) {
		this.logger.debug("Failed to authenticate since password does not match stored value");
		throw new BadCredentialsException(this.messages
				.getMessage("AbstractUserDetailsAuthenticationProvider.badCredentials", "Bad credentials"));
	}
}

UsernamePasswordAuthenticationToken authRequest = UsernamePasswordAuthenticationToken.unauthenticated(username,password);