Authentication providers

An AuthenticationProvider checks credentials against a source, such as users in a database with hashed passwords, and produces an Authentication the rest of the chain trusts. Spring ships providers; you supply the UserDetailsService.

What a session covers

The tutor works through these with you, in conversation and code. A session ends when you have shown them, not when a video does.

Explain what an AuthenticationProvider checks and produces
Implement a UserDetailsService over a user table
Hash passwords with the PasswordEncoder and explain why bcrypt is slow on purpose

In practice

A few lines that show Authentication providers doing its job.

Java

@Bean
UserDetailsService users(UserRepository repo) {
    return username -> repo.findByEmail(username)
        .map(u -> User.withUsername(u.email())
            .password(u.passwordHash())
            .roles(u.role().name())
            .build())
        .orElseThrow(() -> new UsernameNotFoundException(username));
}

@Bean
PasswordEncoder passwordEncoder() { return new BCryptPasswordEncoder(); }

The common mistake

Watch for

Storing passwords with a fast hash such as SHA-256, or none at all. Use the PasswordEncoder with bcrypt or argon2, and never log or return the hash.

What to know first

Your roadmap puts these before Authentication providers, unless you already know them.

The security filter chain

How it stays learned

Once a session shows you understand Authentication providers, it comes back for review. Each review takes a minute and tells the memory model how well you still know it.

Day 3First recall, while it is fresh
Day 7Second, a week on
Day 18Last, when it has settled

Where it leads

Topics that build on Authentication providers.

Previous in the module← The security filter chain

Next in the moduleMethod security →