title: Spring Security authenticating RESTful web service
body: <p>I'm working on adding basic authentication to my RESTful web service (implemented using Spring MVC) with Spring Security having never really used it before. Right now I'm simply using an in-memory <code>UserService</code> with the intention of adding a repository-based one later.</p>
  
  <pre><code>&lt;security:http&gt;
      &lt;security:http-basic /&gt;
      &lt;security:intercept-url pattern="/**" access="ROLE_ADMIN" /&gt;
  &lt;/security:http&gt;
  
  &lt;security:authentication-manager&gt;
      &lt;security:authentication-provider&gt;
          &lt;security:user-service&gt;
              &lt;security:user name="admin" password="admin"
                  authorities="ROLE_USER, ROLE_ADMIN" /&gt;
              &lt;security:user name="guest" password="guest"
                  authorities="ROLE_GUEST" /&gt;
          &lt;/security:user-service&gt;
      &lt;/security:authentication-provider&gt;
  &lt;/security:authentication-manager&gt;
  </code></pre>
  
  <p>This works fine, i.e. sending the following request grants me access to the desired resource (where the encoded string is admin:admin):</p>
  
  <pre><code>GET /user/v1/Tyler HTTP/1.1
  Authorization: Basic YWRtaW46YWRtaW4=
  </code></pre>
  
  <p>And sending the following request gives me an Error 403 (where the encoded string is guest:guest):</p>
  
  <pre><code>GET /user/v1/Tyler HTTP/1.1
  Authorization: Basic Z3Vlc3Q6Z3Vlc3Q=
  </code></pre>
  
  <p>However, sending a request where the provided username is <em>not</em> contained in the <code>UserService</code> does not result in an Error 403 as I expected (or at least desired) but instead continues prompting for a username and password. E.g. (where the encoded string is user:user):</p>
  
  <pre><code>GET /user/v1/Tyler HTTP/1.1
  Authorization: Basic dXNlcjp1c2Vy
  </code></pre>
  
  <p>Is there additional configuration required to respond with an Error 403 when unrecognized user credentials are provided? How can I go about doing that?</p>