When would you write a custom AuthenticationProvider instead of relying on DaoAuthenticationProvider?

When your authentication logic doesn't fit the standard 'fetch UserDetails, compare hashed password' pattern — for example, OTP-based login, verifying against an external legacy identity system, or layering extra business rules (like blocking login during a maintenance window) into the authentication decision itself.