@startuml
Client->IDP:登录\n(带上idpSessionId,帐号/密码)
IDP->SecurityContextPersistenceFilter:doFilter 获取context,\n如果context为空\n则创建新的context
SecurityContextPersistenceFilter->AnonymousAuthenticationFilter:匿名认证filter
AnonymousAuthenticationFilter->AnonymousAuthenticationFilter:createAuthentication(request)\n如果认证信息为空，则创建匿名的认证信息体
AnonymousAuthenticationFilter->SessionManagementFilter:会话管理filter
SessionManagementFilter->SessionManagementFilter:检测sessionId是否有效\n(无效:因为session之前登出过)
SessionManagementFilter->ExceptionTranslationFilter:异常filter
SessionManagementFilter->UsernamePasswordAuthenticationFilter:帐号密码认证信息处理
UsernamePasswordAuthenticationFilter->ProviderManager:authenticate 遍历所有provider
ProviderManager->AuthenticationProvider:认证实现(可自定义)
FilterSecurityInterceptor->FilterSecurityInterceptor:invoke(fi)
FilterSecurityInterceptor->FilterSecurityInterceptor:beforeInvocation(fi)
FilterSecurityInterceptor->AffirmativeBased:decide()判断是否可以访问
AffirmativeBased->ExceptionTranslationFilter:捕获异常(无权限)
ExceptionTranslationFilter->ExceptionTranslationFilter:sendStartAuthentication 发起认证
ExceptionTranslationFilter->ExceptionTranslationFilter:handleSpringSecurityException\n处理安全异常
ExceptionTranslationFilter->ConfigurableSAMLEntryPoint:commence 开始处理AutheRequest
ConfigurableSAMLEntryPoint->ConfigurableSAMLProcessor:sendMessage 给client响应AutheRequest
ConfigurableSAMLProcessor->Client:返回SAMLRequest
Client->IDP:将Request提交到(带上去登的idpSessionId)IDP的/SingleSignOnService
IDP->Client:IDP 校验idpSessionId还有效，\n直接返回RequestResponse；\n而不是让client重定向到填写登录页面
Client->SAMLProcessingFilter:attemptAuthentication(),将RequestResponse 给SP尝试认证
SAMLProcessingFilter->ProxiedSAMLContextProviderLB:getLocalEntity
SAMLProcessingFilter->ConfigurableSAMLProcessor:retrieveMessage 检索认证信息
ConfigurableSAMLProcessor->SAMLProcessingFilter:
SAMLProcessingFilter->ProviderManager:authenticate
ProviderManager->RoleSAMLAuthenticationProvider:authenticate
RoleSAMLAuthenticationProvider->WebSSOProfileConsumerImpl:processAuthenticationResponse 处理idp的响应信息，各种验证，并生成凭据
WebSSOProfileConsumerImpl->ProviderManager
ProviderManager->AuthenticationEventPublisher:publishAuthenticationSuccess \n发送认证成功事件
ProviderManager->SAMLProcessingFilter:返回认证成功信息
SAMLProcessingFilter->SAMLProcessingFilter:successfulAuthentication context设setAuthentication
SAMLProcessingFilter->SavedRequestAwareAuthenticationSuccessHandler:
SavedRequestAwareAuthenticationSuccessHandler->DefaultRedirectStrategy:sendRedirect 向client发送重定向地址
DefaultRedirectStrategy->Client
@enduml
