Spring Security AuthenticationManager

AuthenticationManager is the central Spring Security abstraction that coordinates an authentication attempt. It delegates the work to one or more suitable AuthenticationProvider implementations and returns an authenticated result or signals failure.

In Spring Security, `AuthenticationManager` exposes the core authentication operation through `authenticate(Authentication)`. The caller supplies an `Authentication` object containing credentials or other authentication data, and the manager attempts to authenticate it.

A common implementation is `ProviderManager`. It maintains a collection of `AuthenticationProvider` objects and asks them to handle the request. Each provider can indicate whether it supports a particular authentication type; a provider that supports the request can perform the actual authentication work.

If authentication succeeds, the manager returns an authenticated `Authentication` object. If no suitable provider can authenticate the request, authentication fails, commonly with an `AuthenticationException`.

This separation keeps authentication orchestration separate from the mechanism used to verify credentials. For example, different providers can handle username/password authentication, JWT-based authentication, or other supported authentication mechanisms.

Key points

• `AuthenticationManager` is the central interface for performing authentication.
• `ProviderManager` is a commonly used implementation that delegates to `AuthenticationProvider` instances.
• Providers determine whether they support a particular `Authentication` type.
• Successful authentication returns an authenticated `Authentication` object.
• Authentication failures are represented using `AuthenticationException`.

Interview questions

What is AuthenticationManager in Spring Security?

`AuthenticationManager` is the main abstraction used to authenticate an `Authentication` request. Its `authenticate` method receives the request and either returns an authenticated `Authentication` or fails with an authentication exception. A common implementation, `ProviderManager`, delegates the request to configured authentication providers.

How does AuthenticationManager work with AuthenticationProvider?

An `AuthenticationManager` can delegate an authentication request to `AuthenticationProvider` implementations. Each provider can indicate whether it supports the supplied authentication type. A suitable provider performs the actual authentication and returns an authenticated result when successful. This allows different authentication mechanisms to coexist behind the same manager interface.

What does AuthenticationManager.authenticate() return?

The method returns an `Authentication` representing the result of the authentication attempt. On successful authentication, the returned object normally contains the authenticated principal and authorities established by the authentication mechanism. If authentication cannot be completed successfully, an `AuthenticationException` is thrown instead.

Why separate AuthenticationManager from AuthenticationProvider?

The separation gives Spring Security a consistent entry point for authentication while allowing individual providers to implement different mechanisms. The manager handles coordination, while providers contain mechanism-specific verification logic. This makes the authentication architecture extensible because additional providers can support other authentication types without changing the manager contract.