Spring Security 6 : Define Authentication Provider

 Till now we have used DAOAuthenticationProvider only

Till now we learnt DAOAuthProvider (default) => UserDetailsService

there maybe requirement for custom provider 1) age above 18 2) certain country only

• there maybe different types : all 3 are diff authentication provider
• username & passwd
• oAuth2
• JAAS (legacy , java in built ) 
• The AuthenticationProvider in Spring Security takes care of the authentication logic. 
• The default implementation of the AuthenticationProvider is to delegate the responsibility of finding the user in the system to a UserDetailsService implementation & PasswordEncoder for password validation. But if we have a custom authentication requirement that is not fulfilled by Spring Security framework, then we can build our own authentication logic by implementing the AuthenticationProvider interface.
• It is the responsibility of the ProviderManager which is an implementation of AuthenticationManager, to check with all the implementations of Authentication Providers and try to authenticate the user.
• i think import the right auth provider
• how would ProviderManager know which Auth provider to use ? the type of authentication object will tell (which type of token : username passwd, JAAS , oAuth2)

Authentication Provider Methods

https://www.geeksforgeeks.org/java/spring-security-authentication-providers/

Just has 2 methods

1. authenticate : actual authentication logic , takes Authentication object and returns same ( i think it has a boolean flag that tells authenticated or not also has username and password ) 
• https://docs.spring.io/spring-security/reference/api/java/org/springframework/security/authentication/dao/AbstractUserDetailsAuthenticationProvider.html#authenticate(org.springframework.security.core.Authentication)
2. support
• with this method only the provider manager will pick supported Authentication Provider method
• https://docs.spring.io/spring-security/reference/api/java/org/springframework/security/authentication/dao/AbstractUserDetailsAuthenticationProvider.html#supports(java.lang.Class)
• Returns true if this AuthenticationProvider supports the indicated Authentication object. 
• Returning true does not guarantee an AuthenticationProvider will be able to authenticate the presented Authentication object. It simply indicates it can support closer evaluation of it.

DAOAuthProvider has below method

public boolean supports(Class<?> authentication) {

    return UsernamePasswordAuthenticationToken.class.isAssignableFrom(authentication));

}

Authentication.java is an interface with many classes as implementation

• UsernamePasswordAuthenticationToken
• JAASAuthenticationToken
• OIDCLogoutAuthenticationToken : used for oAuth2
• AnonymousAuthenticationToken : for public pages etc
• TestingAuthenticationToken : for unit testing etc

By time provider manager is invokned Filters are expected to load above type of token

Below code shows how ProviderManager searches for correct AuthenticationProvider inside while loop using Authentication object totest.