title: Spring authentication performed twice, first succeeds and then fails
body: <p>I'm trying to wrap my head around Spring Security framework, and implement authentication using custom <code>AuthenticationProvider</code></p>
  
  <p>When I navigate to secured url and form login with correct credentials, two login attempts are made. First succeeds and second fails, and browser stays at login page without error message.</p>
  
  <p>Here is my security configuration.</p>
  
  <pre><code>package training2;
  
  { imports... }
  
  @Configuration
  @EnableWebSecurity
  public class SecurityConfig extends WebSecurityConfigurerAdapter {
  
      @Autowired
      @Qualifier("myProvider")
      private AuthenticationProvider provider;
  
      @Override
      protected void configure(AuthenticationManagerBuilder auth) throws Exception {
          auth.authenticationProvider(provider);
      }
  
      @Override
      protected void configure(HttpSecurity http) throws Exception {
          http.authorizeRequests()
              .anyRequest().authenticated()
              .and()
              .formLogin()
              .permitAll()
              .and()
              .logout()
              .permitAll();
      }
  
      @Override
      public UserDetailsService userDetailsServiceBean() throws Exception {
          // TODO Auto-generated method stub
          return super.userDetailsServiceBean();
      }
  
      @Override
      @Bean
      protected UserDetailsService userDetailsService() {
          return new UserDetailsService() {
  
              public UserDetails loadUserByUsername(final String username) throws UsernameNotFoundException {
                  System.out.println("loadUserByUsername");
  
                  return new UserDetails() {
  
                      private static final long serialVersionUID = -1044116648365271684L;
  
                      public boolean isEnabled() {
                          // TODO Auto-generated method stub
                          return true;
                      }
  
                      public boolean isCredentialsNonExpired() {
                          // TODO Auto-generated method stub
                          return true;
                      }
  
                      public boolean isAccountNonLocked() {
                          // TODO Auto-generated method stub
                          return true;
                      }
  
                      public boolean isAccountNonExpired() {
                          // TODO Auto-generated method stub
                          return true;
                      }
  
                      public String getUsername() {
                          // TODO Auto-generated method stub
                          return username;
                      }
  
                      public String getPassword() {
                          // TODO Auto-generated method stub
                          return "asdf";
                      }
  
                      public Collection&lt;? extends GrantedAuthority&gt; getAuthorities() {
                          // TODO Auto-generated method stub
                          return null;
                      }
                  };
              }
          };
      }
  
      @Bean
      @Qualifier("myProvider")
      public AuthenticationProvider myProvider(final UserDetailsService userDetailsService) {
          return new AuthenticationProvider() {
  
              public boolean supports(Class&lt;?&gt; authentication) {
                  return true;
              }
  
              public Authentication authenticate(Authentication authentication) throws AuthenticationException {
                  System.out.println("authenticate");
  
                  UserDetails user = userDetailsService.loadUserByUsername(authentication.getName());
                  if (user != null &amp;&amp; user.getPassword().equals(authentication.getCredentials())) {
                      System.out.println("authentication ok");
                      return authentication;
                  } else {
                      System.out.println("authentication failed");
                      throw new AuthenticationException(null) {
                          private static final long serialVersionUID = -1022654748424786317L;
                      };
                  }
              }
          };
      }
  }
  </code></pre>
  
  <p>And following is printed out in the console, when attempting to login with valid credentials</p>
  
  <pre><code>authenticate
  loadUserByUsername
  authentication ok
  authenticate
  loadUserByUsername
  authentication failed
  </code></pre>
  
  <p>When attempting to login with invalid credentials (password anything other than <em>asdf</em>), authentication is performed only once, and fails as it should.</p>
  
  <p>Why is the authentication performed twice on form login, first succeeding and then failing? Is something misconfigured, or am I missing some bean? Also, should I manage the <code>SecurityContext</code> manually, when using custom <code>AuthenticationProvider</code> implementation, or does Spring still manages it and where?</p>
  
  <p>I'm also confused, why I have to explicitly annotate <code>userDetailsService</code> method as a <code>@Bean</code> to make is Spring managed, even though <code>WebSecurityConfigurer</code> declares this method.</p>