How do you expose the AuthenticationManager as an injectable bean for a custom login controller?

By default, AuthenticationManager isn't directly exposed as a bean. You add a @Bean method that calls AuthenticationConfiguration.getAuthenticationManager(), which returns the fully-configured manager Spring Security builds internally — this is then injectable anywhere, including into a custom REST controller that needs to authenticate credentials manually before issuing a token.