spring security AuthenticationManager vs AuthenticationProvider?
authentication, spring, spring-security
Solution
I think the `AuthenticationManager` delegates the fetching of persistent user information to one or more `AuthenticationProvider`s. The authentication-providers (`DaoAuthenticationProvider, JaasAuthenticationProvider, LdapAuthenticationProvider, OpenIDAuthenticationProvider` for example) specialize in accessing specific user-info repositories. Something else is mentioned in this part of the reference manual. It says:
You may want to register additional AuthenticationProvider beans with the ProviderManager and you can do this using the element with the ref attribute, where the value of the attribute is the name of the provider bean you want to add.
In other words, you can specify multiple AuthenticationProviders, for example one that looks for users in an LDAP database and another that looks in an SQL database.
Problem
Can someone tell me the difference between an `AuthenticationManager` and an `AuthenticationProvider` in Spring Security? How are they used and how are they called. It is my understanding that a `SecurityFilter` will call the `AuthenticationManager` to authenticate an `Authentication` object? But then where does the `AuthenticationProvider` come into play? Thanks!