Multiple Authentication Providers in Spring Security

Question

I have configured two authentication providers in my Spring Security config:

   <security:authentication-manager>
      <security:authentication-provider ref="XProvider" />
      <security:authentication-provider ref="YProvider" />
   </security:authentication-manager>

Does spring security evaluate both providers? Or does it stop to evaluate if one of them fails? If not, How to make it stop?

Thanks.

Bulwerlytton

Answer 1

You can specify as many providers as you want. They will be checked in the same order you declared them inside the authentication-manager tag.

Once a successful authentication is made, it will stop polling the providers. If any provider throws an AccountStatusException it will also break the polling.

Ammamaria

This is the correct answer. It should be mentioned, that this is not a core feature of Spring-Security but of the default AuthenticationManager implementation which supports a list of AuthenticationProvider instances. – Uncharitable

How to tell it move to next provider if Exception is not type of AccountStatusException ? – Michel