title: Spring Security Custom Authentication Provider 403 response
body: <p>I'm trying to implement a simple custom authentication provider with Spring Security in a Spring Boot App, but its not working. </p>
  
  <p>My Custom Auth provider is: </p>
  
  <pre><code>@Component
  public class CustomAuthenticationProvider implements AuthenticationProvider{
      @Override
      public Authentication authenticate(Authentication a) {
        try{
          List&lt;GrantedAuthority&gt; roles = new ArrayList&lt;&gt;();
          roles.add(new SimpleGrantedAuthority("USER"));
          UsernamePasswordAuthenticationToken u = new UsernamePasswordAuthenticationToken("usuario", "password", roles);
          return u;
        }catch(Exception e){
          return null;
        }
  }
  
    @Override
    public boolean supports(Class&lt;?&gt; type) {
      return true;
    }
  }
  </code></pre>
  
  <p>And my Security config is this: </p>
  
  <pre><code>@Configuration
  @EnableWebSecurity
  @EntityScan(basePackages = "sirio.io.models")
  public class AppConfiguration {
  
     @Configuration
     @Order(1)
     public static class ApiWebSecurity extends WebSecurityConfigurerAdapter{
         @Autowired
         private CustomAuthenticationProvider customAuthenticationProvider;
  
          @Override
          public void configure(HttpSecurity http) throws Exception{
             http.antMatcher("/admin/**")
                 .authorizeRequests()
                 .anyRequest()
                 .hasRole("USER")
                 .and()
                 .httpBasic()
                 .and()
                 .authenticationProvider(customAuthenticationProvider);
           }
     }
  }
  </code></pre>
  
  <p>I have settled several breakpoints in the CustomAuthProvider and it have been called but i always get a 403 response in the browser</p>
  
  <p>[EDIT]
  Tried another type of Custom Auth Provider but with same result. </p>
  
  <pre><code>@Component
  public class CustomAuthenticationProvider extends AbstractUserDetailsAuthenticationProvider{
  
      @Override
      protected void additionalAuthenticationChecks(UserDetails ud, UsernamePasswordAuthenticationToken upat) throws AuthenticationException {
  
      }
  
      @Override
      protected UserDetails retrieveUser(String string, UsernamePasswordAuthenticationToken upat) throws AuthenticationException{
         List&lt;GrantedAuthority&gt; authoritys = new ArrayList&lt;&gt;();
         authoritys.add(new SimpleGrantedAuthority("USER"));
        UserDetails ud = new User("usuario", "password", authoritys);
        return ud;
      }
  
  }
  </code></pre>