Spring Boot如何发布Authentication*Event？自定义认证事件未触发排查

核心问题定位 #

你自定义了UsernamePasswordAuthenticationFilter和ProviderManager但事件未触发，本质是自定义组件未关联AuthenticationEventPublisher。Spring Security默认流程中，ProviderManager会通过事件发布器触发认证成功/失败事件，但自定义实现时需手动注入并调用。

关键干预环节 #

1. 给自定义ProviderManager绑定事件发布器 #

先将DefaultAuthenticationEventPublisher注册为Spring Bean，再注入到你的ProviderManager中：

@Bean
public AuthenticationEventPublisher authenticationEventPublisher() {
    return new DefaultAuthenticationEventPublisher();
}

// 自定义AuthenticationManager配置
@Bean
public AuthenticationManager authenticationManager(List<AuthenticationProvider> providers,
                                                 AuthenticationEventPublisher eventPublisher) {
    ProviderManager manager = new ProviderManager(providers);
    manager.setAuthenticationEventPublisher(eventPublisher); // 核心：绑定事件发布器
    return manager;
}

2. 过滤器层面的事件触发（可选） #

如果你的过滤器绕过了ProviderManager的认证逻辑、自行处理了认证结果，需要手动调用事件发布器：

@Component
public class InternalUsernamePasswordAuthenticationFilter extends UsernamePasswordAuthenticationFilter {

    private final AuthenticationEventPublisher eventPublisher;

    // 构造注入事件发布器
    public InternalUsernamePasswordAuthenticationFilter(AuthenticationManager authenticationManager,
                                                      AuthenticationEventPublisher eventPublisher) {
        super(authenticationManager);
        this.eventPublisher = eventPublisher;
        // 配置自定义的successHandler和failureHandler
        setAuthenticationSuccessHandler(yourCustomSuccessHandler);
        setAuthenticationFailureHandler(yourCustomFailureHandler);
    }

    @Override
    protected void successfulAuthentication(HttpServletRequest request, HttpServletResponse response, FilterChain chain, Authentication authResult) throws IOException, ServletException {
        // 手动发布认证成功事件
        eventPublisher.publishAuthenticationSuccess(authResult);
        super.successfulAuthentication(request, response, chain, authResult);
    }

    @Override
    protected void unsuccessfulAuthentication(HttpServletRequest request, HttpServletResponse response, AuthenticationException failed) throws IOException, ServletException {
        // 手动发布认证失败事件
        UsernamePasswordAuthenticationToken authToken = 
            new UsernamePasswordAuthenticationToken(request.getParameter("username"), "");
        eventPublisher.publishAuthenticationFailure(failed, authToken);
        super.unsuccessfulAuthentication(request, response, failed);
    }
}

注意：如果你的过滤器通过super(authenticationManager)调用认证逻辑，且ProviderManager已正确绑定事件发布器，那么ProviderManager会自动触发事件，此步骤可省略。

3. 注册事件监听器 #

创建监听器处理发布的事件：

@Component
public class AuthenticationEventListener {

    @EventListener
    public void onAuthSuccess(AuthenticationSuccessEvent event) {
        Authentication auth = event.getAuthentication();
        // 自定义成功事件处理逻辑
        System.out.println("用户[" + auth.getName() + "]认证成功");
    }

    @EventListener
    public void onBadCredentialsFailure(AuthenticationFailureBadCredentialsEvent event) {
        // 处理密码错误场景
        System.out.println("用户[" + event.getAuthentication().getName() + "]认证失败：密码错误");
    }

    @EventListener
    public void onOtherAuthFailures(AuthenticationFailureEvent event) {
        // 处理其他认证失败场景
        System.out.println("用户认证失败：" + event.getException().getMessage());
    }
}

机制原理说明 #

Spring Security认证事件的核心逻辑：

• ProviderManager在authenticate方法执行成功时，调用eventPublisher.publishAuthenticationSuccess
• 认证失败时，DefaultAuthenticationEventPublisher会根据异常类型，发布对应的细分事件（如锁定、禁用、密码错误等）
• 所有事件最终通过Spring的事件广播机制通知监听器

排查要点 #

• 确认DefaultAuthenticationEventPublisher已被注册为Spring Bean
• 检查自定义ProviderManager是否调用了setAuthenticationEventPublisher（从日志看你有DefaultPasswordEncoderAuthenticationManagerBuilder返回null，需确认AuthenticationManager的构建逻辑是否正确）
• 验证认证流程是否走到了ProviderManager的authenticate方法，事件仅在此方法内触发

内容的提问来源于stack exchange，提问作者Slevin