supports(Class<?> authentication) tells an AuthenticationProvider whether it recognizes a supplied Authentication type. AuthenticationManager uses this type check when delegating among providers, but a positive result does not guarantee successful authentication: authenticate() may still reject the request. section 6.1.2
Implement supports() as part of a custom authentication provider:
- Implement the AuthenticationProvider contract. section 6.1.3
- Return true only for the Authentication implementation expected by authenticate(). section 6.1.3
- Implement authenticate() separately, then register the provider with Spring Security. section 6.1.3
Username-and-password provider
A provider handling standard username-and-password requests can return authenticationType.equals(UsernamePasswordAuthenticationToken.class). It then retrieves UserDetails, checks the password with a PasswordEncoder, and returns an authenticated token or raises an authentication exception. section 6.1.3
Listing 6.3 Overriding the supports() method of the AuthenticationProvider
@Component
public class CustomAuthenticationProvider
implements AuthenticationProvider {
// Omitted code
@Override
public boolean supports(Class<?> authenticationType) {
return authenticationType
.equals(UsernamePasswordAuthenticationToken.class);
}
}
Use the listing to inspect the minimal supports() override and its exact class comparison. section 6.1.3
