mirror of
https://github.com/spring-projects/spring-security.git
synced 2025-05-31 17:22:13 +00:00
f01a13aa52
mkdir -p docs/modules/ROOT/ mkdir -p docs/modules/ROOT/pages/ git checkout antora-2.x docs/antora.yml git checkout antora-2.x docs/modules/ROOT/nav.adoc mv docs/manual/src/docs/asciidoc/images docs/modules/ROOT/ mv docs/manual/src/docs/asciidoc/_includes/* docs/modules/ROOT/pages/ cp ~/code/rwinch/spring-reference/*antora* ~/code/spring-projects/spring-security/ mv docs/modules/ROOT/pages/about docs/modules/ROOT/pages/overview
19 lines
1.0 KiB
Plaintext
19 lines
1.0 KiB
Plaintext
[[servlet-authentication-authentication]]
|
|
= Authentication
|
|
|
|
The {security-api-url}org/springframework/security/core/Authentication.html[`Authentication`] serves two main purposes within Spring Security:
|
|
|
|
* An input to <<servlet-authentication-authenticationmanager,`AuthenticationManager`>> to provide the credentials a user has provided to authenticate.
|
|
When used in this scenario, `isAuthenticated()` returns `false`.
|
|
* Represents the currently authenticated user.
|
|
The current `Authentication` can be obtained from the <<servlet-authentication-securitycontext>>.
|
|
|
|
The `Authentication` contains:
|
|
|
|
* `principal` - identifies the user.
|
|
When authenticating with a username/password this is often an instance of <<servlet-authentication-userdetails,`UserDetails`>>.
|
|
* `credentials` - often a password.
|
|
In many cases this will be cleared after the user is authenticated to ensure it is not leaked.
|
|
* `authorities` - the <<servlet-authentication-granted-authority,``GrantedAuthority``s>> are high level permissions the user is granted.
|
|
A few examples are roles or scopes.
|