title: How to fix "Bad credentials" error using authentication manager?
body: <p>I'm doing a project in which you have to register some users and also giving them a rol (user by default). After I've registered a user, I added  jwt auth and I was able to get the jwt response, but after trying to implement some filters on it, the code started to fail.</p>
  <p>At this point I've commented the filter implementation method and also inside my WebSecurityConfig.</p>
  <p>It's supposed that I'll receive a username and password inside my endpoint (&quot;authenticate/&quot;).</p>
  <pre><code>@RequestMapping(
              value = {&quot;authenticate&quot;, &quot;authenticate/&quot;},
              method = RequestMethod.POST,
              consumes = {
                      MediaType.APPLICATION_FORM_URLENCODED_VALUE,
                      MediaType.MULTIPART_FORM_DATA_VALUE,
                      MediaType.APPLICATION_JSON_VALUE
              },
              produces = MediaType.APPLICATION_JSON_VALUE
      )
      public @ResponseBody AuthResponse login(AuthRequest authRequest) throws Exception
      {
          return this.authService.authenticate(authRequest);
      }
  </code></pre>
  <p>AuthRequest is username and password.</p>
  <pre><code>@AllArgsConstructor
  @NoArgsConstructor
  @Setter
  @Getter
  public class AuthResponse
  {
      private String username;
      private String password;
  }
  </code></pre>
  <p>But the error is when I try to authenticate the user using the AuthenticationManager.</p>
  <p>AuthService authenticate method</p>
  <pre><code>public AuthResponse authenticate(AuthRequest authRequest) throws Exception
      {
          //System.out.println(authRequest.getUsername() +&quot;,&quot; + authRequest.getPassword() + &quot;,&quot; + this.bCryptPasswordEncoder.encode(authRequest.getPassword()));
          try {
              this.authenticationManager.authenticate(
                      new UsernamePasswordAuthenticationToken(authRequest.getUsername(), authRequest.getPassword())
              );
          } catch (BadCredentialsException e) {
              //Here is the error
              throw new Exception(&quot;Incorrect username or password&quot;, e);
          }
  
          final UserDetails userDetails = usersDetailService.loadUserByUsername(authRequest.getUsername());
          final String jwt = jwtUtil.generateToken(userDetails);
          //this.logService.save(new Log(null, userDetails.getUsername(), jwt, null));
          System.out.println(jwt);
          return new AuthResponse(jwt);
      }
  </code></pre>
  <p>Error inside postman console.</p>
  <pre><code>&quot;timestamp&quot;: &quot;2021-04-03T19:23:01.510+00:00&quot;,
      &quot;status&quot;: 403,
      &quot;error&quot;: &quot;Forbidden&quot;,
      &quot;trace&quot;: &quot;java.lang.Exception: Incorrect username or password\n\tat com.cncipo.nl.auth.service.AuthService.authenticate2(AuthService.java:60)\n\tat com.cncipo.nl.controller.SessionRestController.auth(SessionRestController.java:85)\n\tat sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)\n\tat sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)\n\tat sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)\n\tat java.lang.reflect.Method.invoke(Method.java:498)\n\tat org.springframework.web.method.support.InvocableHandlerMethod.doInvoke(InvocableHandlerMethod.java:197)\n\tat org.springframework.web.method.support.InvocableHandlerMethod.invokeForRequest(InvocableHandlerMethod.java:141)\n\tat org.springframework.web.servlet.mvc.method.annotation.ServletInvocableHandlerMethod.invokeAndHandle(ServletInvocableHandlerMethod.java:106)\n\tat org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.invokeHandlerMethod(RequestMappingHandlerAdapter.java:894)\n\tat org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.handleInternal(RequestMappingHandlerAdapter.java:808)\n\tat org.springframework.web.servlet.mvc.method.AbstractHandlerMethodAdapter.handle(AbstractHandlerMethodAdapter.java:87)\n\tat org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:1060)\n\tat org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:962)\n\tat org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:1006)\n\tat org.springframework.web.servlet.FrameworkServlet.doPost(FrameworkServlet.java:909)\n\tat javax.servlet.http.HttpServlet.service(HttpServlet.java:652)\n\tat org.springframework.web.servlet.FrameworkServlet.service(FrameworkServlet.java:883)\n\tat javax.servlet.http.HttpServlet.service(HttpServlet.java:733)\n\tat org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:227)\n\tat org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162)\n\tat org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:53)\n\tat org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:189)\n\tat org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162)\n\tat org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:327)\n\tat org.springframework.security.web.access.intercept.FilterSecurityInterceptor.invoke(FilterSecurityInterceptor.java:115)\n\tat org.springframework.security.web.access.intercept.FilterSecurityInterceptor.doFilter(FilterSecurityInterceptor.java:81)\n\tat org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:336)\n\tat org.springframework.security.web.access.ExceptionTranslationFilter.doFilter(ExceptionTranslationFilter.java:119)\n\tat org.springframework.security.web.access.ExceptionTranslationFilter.doFilter(ExceptionTranslationFilter.java:113)\n\tat org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:336)\n\tat org.springframework.security.web.session.SessionManagementFilter.doFilter(SessionManagementFilter.java:126)\n\tat org.springframework.security.web.session.SessionManagementFilter.doFilter(SessionManagementFilter.java:81)\n\tat org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:336)\n\tat org.springframework.security.web.authentication.AnonymousAuthenticationFilter.doFilter(AnonymousAuthenticationFilter.java:105)\n\tat org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:336)\n\tat org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter.doFilter(SecurityContextHolderAwareRequestFilter.java:149)\n\tat org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:336)\n\tat org.springframework.security.web.savedrequest.RequestCacheAwareFilter.doFilter(RequestCacheAwareFilter.java:63)\n\tat org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:336)\n\tat org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.java:103)\n\tat org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.java:89)\n\tat org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:336)\n\tat org.springframework.security.web.header.HeaderWriterFilter.doHeadersAfter(HeaderWriterFilter.java:90)\n\tat org.springframework.security.web.header.HeaderWriterFilter.doFilterInternal(HeaderWriterFilter.java:75)\n\tat org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119)\n\tat org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:336)\n\tat org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:110)\n\tat org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:80)\n\tat org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:336)\n\tat org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter.doFilterInternal(WebAsyncManagerIntegrationFilter.java:55)\n\tat org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119)\n\tat org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:336)\n\tat org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:211)\n\tat org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:183)\n\tat org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:358)\n\tat org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:271)\n\tat org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:189)\n\tat org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162)\n\tat org.springframework.web.filter.RequestContextFilter.doFilterInternal(RequestContextFilter.java:100)\n\tat org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119)\n\tat org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:189)\n\tat org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162)\n\tat org.springframework.web.filter.FormContentFilter.doFilterInternal(FormContentFilter.java:93)\n\tat org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119)\n\tat org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:189)\n\tat org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162)\n\tat org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:201)\n\tat org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119)\n\tat org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:189)\n\tat org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162)\n\tat org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:202)\n\tat org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:97)\n\tat org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:542)\n\tat org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:143)\n\tat org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:92)\n\tat org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:78)\n\tat org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:357)\n\tat org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:374)\n\tat org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:65)\n\tat org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:893)\n\tat org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1707)\n\tat org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49)\n\tat java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)\n\tat java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)\n\tat org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)\n\tat java.lang.Thread.run(Thread.java:748)\nCaused by: org.springframework.security.authentication.BadCredentialsException: Bad credentials\n\tat org.springframework.security.authentication.dao.AbstractUserDetailsAuthenticationProvider.authenticate(AbstractUserDetailsAuthenticationProvider.java:141)\n\tat org.springframework.security.authentication.ProviderManager.authenticate(ProviderManager.java:182)\n\tat org.springframework.security.authentication.ProviderManager.authenticate(ProviderManager.java:201)\n\tat org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter$AuthenticationManagerDelegator.authenticate(WebSecurityConfigurerAdapter.java:518)\n\tat com.cncipo.nl.auth.service.AuthService.authenticate2(AuthService.java:56)\n\t... 86 more\n&quot;,
      &quot;message&quot;: &quot;Access Denied&quot;,
      &quot;path&quot;: &quot;/api/authenticate&quot;
  }
  </code></pre>
  <p>I'll add the WebSecurityConfig and the JwtFilter in case there is something that I missed and it's causing the error.</p>
  <p>JwtFilter</p>
  <pre><code>//@Component
  public class JwtRequestFilter extends OncePerRequestFilter
  {
  
      @Autowired
      private UsersDetailService usersDetailService;
  
      @Autowired
      private JwtUtil jwtUtil;
  
      @Override
      protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException
      {
          /* Get the header for auth */
          final String authHeader =  request.getHeader(&quot;Authorization&quot;);
          String username = null;
          String jwt = null;
  
          System.out.println(&quot;Flag of header it's null when I implemented&quot; + authHeader);
  
          /* Extract jwt and username */
          if (authHeader != null &amp;&amp; authHeader.startsWith(&quot;Bearer &quot;))
          {
              jwt = authHeader.substring(7);
              username = jwtUtil.extractUsername(jwt);
          }
  
          /* Extract user details */
          if (username != null &amp;&amp; SecurityContextHolder.getContext().getAuthentication() == null)
          {
              UserDetails userDetails = this.usersDetailService.loadUserByUsername(username);
  
              if (jwtUtil.validateToken(jwt, userDetails))
              {
                  /* Create default new jwt auth token */
                  UsernamePasswordAuthenticationToken usernamePasswordAuthenticationToken = new UsernamePasswordAuthenticationToken(
                          userDetails, null, userDetails.getAuthorities());
                  usernamePasswordAuthenticationToken.setDetails(new WebAuthenticationDetailsSource().buildDetails(request));
                  SecurityContextHolder.getContext().setAuthentication(usernamePasswordAuthenticationToken);
              }
          }
          /* Handling the control to the next filter chain */
          filterChain.doFilter(request, response);
      }
  }
  </code></pre>
  <p>WebSecurityConfig</p>
  <pre><code>@EnableWebSecurity
  @Configuration
  public class WebSecurityConfig extends WebSecurityConfigurerAdapter
  {
  
      @Autowired
      private UsersDetailService usersDetailService;
  
      //@Autowired
      //private JwtRequestFilter jwtRequestFilter;
  
      @Bean
      public BCryptPasswordEncoder passwordEncoder()
      {
          return new BCryptPasswordEncoder();
      }
  
      @Override
      public void configure(AuthenticationManagerBuilder auth) throws Exception
      {
          auth.userDetailsService(usersDetailService);
      }
  
      /* Bean of AuthManager due to it used to work in older version of spring */
      @Override
      @Bean
      public AuthenticationManager authenticationManagerBean() throws Exception
      {
          return super.authenticationManagerBean();
      }
  
      @Override
      protected void configure(HttpSecurity http) throws Exception
      {
          /* Disable security */
          http.csrf().disable();
  
          /* User info page requires login as admin and user role. If no login, redirect */
          http.authorizeRequests().antMatchers(&quot;users&quot;).access(&quot;hasAnyRole('admin', 'user')&quot;);
  
          /* Only for admin */
          http.authorizeRequests().antMatchers(&quot;logs&quot;, &quot;admin&quot;).access(&quot;hasRole('admin')&quot;);
  
          /* The pages does not require login/auth */
          http.authorizeRequests().antMatchers(&quot;login&quot;, &quot;logout&quot;, &quot;/authenticate/, login/&quot;)
                  .permitAll();//.anyRequest().authenticated();
  
          /* Using sessiong managment for intercept jwt auth . Spring won't create session, jwt will manage them*/
          //http.exceptionHandling().and().sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);
          //http.addFilterBefore(jwtRequestFilter, UsernamePasswordAuthenticationFilter.class);
  
      }
  }
  </code></pre>
  <p>UsersDetailService, MyUserDetails implements UserDetails from <strong>import org.springframework.security.core.userdetails.UserDetails;</strong></p>
  <pre><code>@Service
  public class UsersDetailService implements UserDetailsService
  {
      @Autowired
      private UserRepository userRepository;
  
      @Override
      public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException
      {
          User user = this.userRepository.getUserByUsername_user(username);
  
          if (user == null) { throw new UsernameNotFoundException(&quot;Could not find user&quot;); }
          return new MyUserDetails(user);
      }
  }
  </code></pre>