Java 보안 메커니즘의 인증 및 권한 부여 메커니즘은 어떻게 구현됩니까?

// 基于密码的认证
String username = "admin";
String password = "secret";
boolean authenticated = authManager.authenticate(username, password);

// 基于令牌的认证
String token = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...";
boolean authenticated = authManager.authenticate(token);

// 基于角色的授权
String role = "admin";
boolean authorized = authManager.authorize(authenticatedUser, role);

// 基于权限的授权
String permission = "READ_USER";
boolean authorized = authManager.authorize(authenticatedUser, permission);

@WebServlet("/user")
public class UserServlet extends HttpServlet {

    @Override
    protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws IOException {
        // 检查授权
        if (!authManager.authorize(req.getUserPrincipal(), "READ_USER")) {
            resp.setStatus(403);
            resp.getWriter().write("没有访问权限！");
            return;
        }

        // 加载并显示用户数据
        User user = userRepository.findById(req.getParameter("id"));
        resp.getWriter().write(user.toString());
    }
}