public class ProviderManager extends Object implements AuthenticationManager, MessageSourceAware, InitializingBean
Authenticationrequest through a list of
AuthenticationProviders are usually tried in order until one provides a non-null response.
A non-null response indicates the provider had authority to decide on the authentication request and no further
providers are tried.
If a subsequent provider successfully authenticates the request, the earlier authentication exception is disregarded
and the successful authentication will be used. If no subsequent provider provides a non-null response, or a new
AuthenticationException, the last
AuthenticationException received will be used.
If no provider returns a non-null response, or indicates it can even process an
ProviderManager will throw a
AuthenticationManager can also be set, and this will also be tried if none of the configured
providers can perform the authentication. This is intended to support namespace configuration options though and
is not a feature that should normally be required.
The exception to this process is when a provider throws an
AccountStatusException, in which case no
further providers in the list will be queried.
Post-authentication, the credentials will be cleared from the returned
Authentication object, if it
CredentialsContainer interface. This behaviour can be controlled by modifying the
Authentication event publishing is delegated to the configured
AuthenticationEventPublisher which defaults
to a null implementation which doesn't publish events, so if you are configuring the bean yourself you must inject
a publisher bean if you want to receive events. The standard implementation is
which maps common exceptions to events (in the case of authentication failure) and publishes an
authentication succeeds. If you are using the namespace then an instance of this bean will be used automatically by
the <http> configuration, so you will receive events from the web part of your application automatically.
Note that the implementation also publishes authentication failure events when it obtains an authentication result
(or an exception) from the "parent"
AuthenticationManager if one has been set. So in this situation, the
parent should not generally be configured to publish events or there will be duplicates.
|Modifier and Type||Field and Description|
|Constructor and Description|
|Modifier and Type||Method and Description|
Attempts to authenticate the passed
If set to, a resulting
protected MessageSourceAccessor messages
public void afterPropertiesSet() throws Exception
public Authentication authenticate(Authentication authentication) throws AuthenticationException
The list of
AuthenticationProviders will be successively tried until an
AuthenticationProvider indicates it is capable of authenticating the type of
Authentication object passed. Authentication will then be attempted with that
If more than one
AuthenticationProvider supports the passed
object, only the first
AuthenticationProvider tried will determine the result. No subsequent
AuthenticationProviders will be tried.
public void setMessageSource(MessageSource messageSource)
public void setAuthenticationEventPublisher(AuthenticationEventPublisher eventPublisher)
public void setEraseCredentialsAfterAuthentication(boolean eraseSecretData)
Authenticationwhich implements the
CredentialsContainerinterface will have its
eraseCredentialsmethod called before it is returned from the
eraseSecretData- set to false to retain the credentials data in memory. Defaults to true.
public boolean isEraseCredentialsAfterAuthentication()