Java Spring Security 中的“主体”是什么？
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/37499307/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
What's the "principal" in Spring Security?
提问by nbro
I'm really new to Spring and Spring Security. I was reading about Spring Security and it came out the concept of principal, which should be the current logged user. But what if we have more than one current logged user? So, my question is, what exactly is then the principal in spring security?
我对 Spring 和 Spring Security 真的很陌生。我正在阅读有关 Spring Security 的内容，它提出了principal的概念，它应该是当前登录的用户。但是如果我们有不止一个当前登录的用户呢？所以，我的问题是，那么 Spring Security 的委托人究竟是什么？
I've read for example this tutorial:
例如，我已阅读本教程：
http://www.mkyong.com/spring-security/get-current-logged-in-username-in-spring-security/
http://www.mkyong.com/spring-security/get-current-logged-in-username-in-spring-security/
and they seem to take into account that there's just one current logged user, which isn't often the case.
而且他们似乎考虑到当前只有一个登录用户，但情况并非如此。
How do I retrieve a specific user? And how do I differentiate between users that are doing requests?
如何检索特定用户？以及如何区分正在执行请求的用户？
采纳答案by Marcel St?r
The principal isthe currently logged in user. However, you retrieve it through the security context which is bound to the current thread and as such it's also bound to the current request and its session.
主体是当前登录的用户。但是，您通过绑定到当前线程的安全上下文检索它，因此它也绑定到当前请求及其会话。
SecurityContextHolder.getContext()internally obtains the current SecurityContextimplementation through a ThreadLocalvariable. Because a request is bound to a single thread this will get you the context of the current request.
SecurityContextHolder.getContext()内部SecurityContext通过一个ThreadLocal变量获取当前的实现。因为请求绑定到单个线程，这将为您提供当前请求的上下文。
To simplify you could say that the security context is in the session and contains user/principal and roles/authorities.
为简化起见，您可以说安全上下文在会话中并包含用户/主体和角色/权限。
How do I retrieve a specific user?
如何检索特定用户？
You don't. All APIs are designed to allow access to the user & session of the current request. Let user A be one of 100 currently authenticated users. If A issues a request against your server it will allocate one thread to process that request. If you then do SecurityContextHolder.getContext().getAuthentication()you do so in the context of this thread. By default from within that thread you don't have access to the context of user B which is processed by a different thread.
你没有。所有 API 都旨在允许访问当前请求的用户和会话。让用户 A 成为 100 个当前已通过身份验证的用户之一。如果 A 向您的服务器发出请求，它将分配一个线程来处理该请求。如果你那么做，SecurityContextHolder.getContext().getAuthentication()你就在这个线程的上下文中这样做。默认情况下，在该线程内，您无权访问由不同线程处理的用户 B 的上下文。
And how do I differentiate between users that are doing requests?
以及如何区分正在执行请求的用户？
You don't have to, that's what the Servlet container does for you.
您不必这样做，这就是 Servlet 容器为您所做的。
