从过滤器开始

FormAuthenticationFilter.onAccessDenied

executeLogin(request, response);

subject.login(token);

securityManager.login(this, token);

createSubject(token, info, subject);

createSubject(context);

save(subject);

this.subjectDAO.save(subject);

saveToSession(subject);

mergePrincipals(subject);    session.setAttribute(DefaultSubjectContext.PRINCIPALS_SESSION_KEY, currentPrincipals);

mergeAuthenticationState(subject);   

session.setAttribute(DefaultSubjectContext.AUTHENTICATED_SESSION_KEY, Boolean.TRUE);