title: Spring Security custom AuthenticationProvider authenticate method called twice
body: <p>I am developing a Spring Boot that uses an API Key to authenticate. I have created a custom Authentication provider and the authenticate method is called twice. Can anyone tell me why it's being called twice?</p>
  
  <p>This is my authenticate method:</p>
  
  <pre><code>@Override
  public Authentication authenticate(Authentication authentication) throws AuthenticationException {
      ApiAuthenticationToken authenticationToken = (ApiAuthenticationToken) authentication;
  
      /**
       * Authenticate the token
       */
      ValidateApiKeyRequest request = new ValidateApiKeyRequest(authenticationToken.getApiKey());
      ValidateApiKeyResp resp = getValidateApiKeyCommand().execute(request);
  
      /**
       * Populate and return a new authenticaiton token
       */
      return createSuccessAuthentication(resp);
  }
  </code></pre>
  
  <p>and this is the createSuccessAuthentication method:</p>
  
  <pre><code>protected Authentication createSuccessAuthentication(final ValidateApiKeyResp resp) {
      List&lt;GrantedAuthority&gt; authorities = Lists.newArrayList();
      authorities.add(new SimpleGrantedAuthority("API_KEY"));
      return new ApiAuthenticationToken(resp.getApiKey(), authorities, true);
  }
  </code></pre>
  
  <p>this is the ApiAuthenticationToken constructor:</p>
  
  <pre><code>public ApiAuthenticationToken(final ApiKey apiKey, Collection&lt;? extends GrantedAuthority&gt; authorities, boolean authenticated) {
      super(authorities);
      setAuthenticated(true);
      this.apiKey = apiKey;
  }
  </code></pre>
  
  <p>This is my security configuration:</p>
  
  <pre><code>protected void configure(HttpSecurity http) throws Exception {
      http.antMatcher(CONFIGURATION_MATCHER)
          .exceptionHandling().authenticationEntryPoint(restAuthenticationEntryPoint())
          .and()
          .addFilterBefore(apiKeyAuthenticationFilter(), UsernamePasswordAuthenticationFilter.class)
          .csrf().disable()
          .authorizeRequests().antMatchers(CONFIGURATION_MATCHER).authenticated()
          .and()
          .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS)
          .and()
          .authenticationProvider(apiKeyAuthenticationProvider());
  </code></pre>