PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchiTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Adding a second Spring Security AuthenticationProvider is supported; it does not automatically break login. A regression can occur when the new provider also supports the authentication token used by an existing flow and its position or response changes what ProviderManager does next. The key distinction is whether a provider returns an authenticated result, returns null to abstain, or throws an exception.
How Spring Security delegates authentication
Spring Security filters use an AuthenticationManager to authenticate a request. The commonly used implementation, ProviderManager, delegates that request to its configured list of AuthenticationProvider instances. This lets one manager support different authentication mechanisms. The framework documentation describes providers as able to succeed, fail, or indicate that they cannot decide and let a downstream provider decide (Spring Security 7.1.1 authentication architecture).
A provider’s supports(Class<?>) method is a capability check, not a promise that it can authenticate every request of that class. Its authenticate(Authentication) method can still return null when it cannot make a decision for the particular request. In that case, another supporting provider may be tried. These distinctions are part of the Spring Security 7.1.1 AuthenticationProvider API.
Free tools Windows power users keep installed
One-click scans. No signup required.
What happens when a provider is added
ProviderManager generally checks its providers in order. A provider that returns a non-null authentication result ends the search. A provider that returns null abstains, allowing the manager to continue to another provider that supports the request. An AuthenticationException represents a failed attempt rather than an abstention: a later provider can still succeed, in which case that success is used. If no provider succeeds, the last authentication exception is rethrown. The documented exception to continuing after a failure is AccountStatusException, which stops further provider queries. See the Spring Security 7.0.7 ProviderManager API.
#1 Best Overall
| Provider outcome | Effect on the provider search |
|---|---|
| Returns a non-null result | The result is used and later providers are not consulted. |
Returns null |
The provider abstains; the manager may try the next supporting provider. |
Throws an AuthenticationException |
A later provider may still succeed. If no later provider succeeds, the last authentication exception is rethrown. |
Throws an AccountStatusException |
Further provider queries stop. |
| No provider can process the authentication type | The manager can throw ProviderNotFoundException. |
Consequently, provider order matters when providers overlap. If a newly added provider claims support for the same token class as an existing provider, it becomes part of that request’s path. It might authenticate first and prevent later providers from running, abstain and allow them to run, or throw an exception that changes the failure path. That is a possible configuration regression, not a rule that adding a second provider breaks authentication.
Trace the failing authentication request
Use the actual authentication token and runtime configuration to find where the flow changes. The official API documentation defines general behavior, but cannot establish which provider your application registers first or what a custom provider does with a particular request.
- Identify the token. Find the exact
Authenticationimplementation produced by the failing filter or login flow. - Check provider support and order. For each provider registered with the relevant manager, determine whether
supportsreturns true for that token class, and establish the effective order. - Follow each provider’s outcome. For the first provider that receives the request, determine whether
authenticatereturns a non-null result, returnsnull, throws anAuthenticationException, or throws anAccountStatusException. Continue tracing only as the outcome permits. - Check manager selection and fallback. If no local provider handles the request, check whether its
ProviderManagerhas a parentAuthenticationManager. Also verify that the request is handled by the expectedSecurityFilterChainand manager. Spring’s 6.5.11 architecture reference documents the parent-manager design as well as provider delegation. - Compare the working and failing configurations. Inspect the before-and-after provider list, order, support checks, and actual outcomes. Use logs or a debugger to confirm the application’s runtime wiring rather than inferring the cause from the number of providers alone.
Use a known provider as a comparison point
DaoAuthenticationProvider is Spring Security’s documented username-and-password example. It uses a UserDetailsService and a PasswordEncoder (Spring Security 7.1.1 DaoAuthenticationProvider). It can help you reason about an application that uses that provider, but it should not be assumed that every newly added provider handles username-and-password tokens or that all providers share the same support behavior.
Recommended Free Tools
Check behavior against your Spring Security version
The architecture and API links above are versioned: the architecture and AuthenticationProvider API references are for Spring Security 7.1.1, the detailed ProviderManager iteration rules are from 7.0.7, and the parent-manager architecture reference is from 6.5.11. Check the documentation matching your project’s dependency when investigating release-sensitive behavior.
Quick Recap
Best Value
Rank #4
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
