Custom vs Default Credential Authentication in Spring Security

Let’s compares the default credential authentication process used by Spring Security and the custom credential authentication logic defined in the CustomAuthenticationProvider of the auth-service module.

⚙️ Default Credential Flow (Current Behavior)

By default, AdventureTube’s auth-service uses Spring Security’s built-in DaoAuthenticationProvider through this configuration:

authenticationManagerBuilder
    .userDetailsService(userDetailsService)
    .passwordEncoder(passwordEncoder());

🔁 Flow

1. Spring injects DaoAuthenticationProvider

2. It uses your CustomUserDetailService to load user by email

3. It uses BCryptPasswordEncoder to compare passwords

4. If valid, it returns an authenticated UsernamePasswordAuthenticationToken

✅ Pros

• Simple and standard

• No need to write extra logic

• Well-supported by Spring ecosystem

❌ Limitations

• No hook for logging, auditing, or pre/post validation

• Limited flexibility to handle complex credential logic or multi-source auth

🛠️ Custom Credential Flow (CustomAuthenticationProvider)

You have defined a custom provider:

public class CustomAuthenticationProvider extends DaoAuthenticationProvider {
    @Override
    public Authentication authenticate(Authentication authentication) throws AuthenticationException {
        // Manually load user, validate password
        return new UsernamePasswordAuthenticationToken(...);
    }
}

🧩 How It Works

• Fully overrides authenticate()

• Manually loads user and verifies password

• Can throw custom exceptions (e.g. logging failed attempts)

• Can be extended to support external token-based or multi-factor logic

🧪 How to Activate

To enable it, modify your config:

@Bean
public AuthenticationManager customAuthenticationManager(HttpSecurity httpSecurity) throws Exception {
    AuthenticationManagerBuilder builder = httpSecurity.getSharedObject(AuthenticationManagerBuilder.class);
    builder.authenticationProvider(customAuthenticationProvider());
    return builder.build();
}

@Bean
public CustomAuthenticationProvider customAuthenticationProvider() {
    CustomAuthenticationProvider provider = new CustomAuthenticationProvider();
    provider.setUserDetailsService(userDetailsService);
    provider.setPasswordEncoder(passwordEncoder());
    return provider;
}

✅ Pros

• Full control over auth process

• Easy to extend for non-standard login types

• Better for audit trails, dynamic credential checks

❌ Considerations

• Slightly more boilerplate

• Must manually handle exceptions correctly

✅ Summary Table

You can safely use the default flow for typical use cases, but the custom provider gives you full flexibility when needed.