If two AuthenticationProvider beans both support UsernamePasswordAuthenticationToken, what happens?

ProviderManager iterates the configured provider list in order. Each supporting provider gets a chance to authenticate; if one throws a definitive failure exception like BadCredentialsException, ProviderManager typically stops and propagates that failure rather than silently falling through to the next provider (though behavior can be tuned) — so provider ORDER and exception semantics both matter when multiple providers could apply.