问AuthenticationProvider未进行身份验证

EN

@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(securedEnabled = true,prePostEnabled=true)
public class MyWebSecurityConfigurerAdapter extends WebSecurityConfigurerAdapter {

    @Autowired
    private BokiAuthenticationProvider bokiAuthenticationProvider;

    @Autowired
    private MyCredentialsFilter myCredentialsFilter;

    @Override
    protected void configure(HttpSecurity http) throws Exception {

        // request handling
        http.authorizeRequests()
            .antMatchers(HttpMethod.GET, "/users").hasRole("USER")
            .antMatchers(HttpMethod.GET, "/users/*").hasRole("USER")
            .antMatchers(HttpMethod.POST, "/users").permitAll()
            .antMatchers(HttpMethod.PATCH, "/users/*").hasRole("USER")
            .antMatchers(HttpMethod.DELETE, "/users/*").hasRole("USER")
            .antMatchers(HttpMethod.POST, "/login").permitAll()
            ;

        // disable csrf
        http.csrf().disable();

        // app session is stateless
        http.sessionManagement()
            .sessionCreationPolicy(SessionCreationPolicy.STATELESS);        

        http.addFilterBefore(myCredentialsFilter, UsernamePasswordAuthenticationFilter.class);
    }

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.eraseCredentials(false)
            .authenticationProvider(bokiAuthenticationProvider);
    }
}

@Component
public class CredentialsFilter extends OncePerRequestFilter{

    @Autowired
    private MyCriptoService myCriptoService;

    public CredentialsFilter(){
        super();
    }

    @Override
    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain chain)
            throws ServletException, IOException {

        if(request.getRequestURI().contains("login")){
            chain.doFilter(request, response);
        }else{
            String token = request.getHeader("MyTokenHeader");
            String username = myCriptoService.getUsernameFromToken(token);
            if (username!=null && SecurityContextHolder.getContext().getAuthentication()==null){
                UsernamePasswordAuthenticationToken 
                authentication = new UsernamePasswordAuthenticationToken(
                                        username, 
                                        myCriptoService.getPasswordFromToken(token), 
                                        myCriptoService.getAuthoritiesFromToken(token));

                SecurityContextHolder.getContext().setAuthentication(authentication);
                chain.doFilter(request, response);
            }
        }
    }

}

@Component
public class BokiAuthenticationProvider implements AuthenticationProvider {

    @Autowired
    private MyUserRepository myUserRepository;

    @Autowired
    private MyCriptoService myCryptoService;

    @Override
    public Authentication authenticate(Authentication auth) throws AuthenticationException {
        String username = auth.getName();

        if(username!=null && !"".equals(username)){
            MyUserJPA jpa = myUserRepository.findByUsername(username);

            if(jpa!=null){
                String password = auth.getCredentials().toString();
                if(myCryptoService.checkPasswords(password, jpa.getPassword())){

                    @SuppressWarnings("unchecked")
                    List<SimpleGrantedAuthority> authorities = (List<SimpleGrantedAuthority>) auth.getAuthorities();

                    return new UsernamePasswordAuthenticationToken(
                            jpa.getUsername(),
                            null,
                            authorities);
                }
                throw new MyBadCredentialsException("Passwords is missing or invalid.");
            }
            throw new MyBadCredentialsException("There is no user with username = "+username);
        }

        throw new MyBadCredentialsException("You did not provide a username.");
    }

    @Override
    public boolean supports(Class<?> authentication) {
        return authentication.equals(UsernamePasswordAuthenticationToken.class);
    }
}