intermediateCustom AuthenticationProvider & Exception Handling

If two AuthenticationProvider beans both support UsernamePasswordAuthenticationToken, what happens?

ProviderManager iterates the configured provider list in order. Each supporting provider gets a chance to authenticate; if one throws a definitive failure exception like BadCredentialsException, ProviderManager typically stops and propagates that failure rather than silently falling through to the next provider (though behavior can be tuned) — so provider ORDER and exception semantics both matter when multiple providers could apply.

Ready to master this question?

Generate a complete walkthrough — background, the full answer in plain language, a working code example explained line by line, a real-world scenario, common mistakes, and how this same question gets asked in different ways.

Next Step

Continue to What is a session fixation attack, and how does Spring Security prevent it by default? →← Back to all Spring Security questions