title: Custom User Details and Custom Authentication provider are never called
body: <p>I need some additional data in in the user details of authenticated users. So i wrote a custom details service and as a second approach a custom authentication provider to enrich the data in the user object. But the principal object in the security context stays a string instead of becoming the desired user object and when i'm setting breakpoints im my custom details service and authentication porvider it looks like this code is never used by spring albeit my customized classes are listed in springs authentication manager builder.</p>
  
  <p>This is my custom user details service:</p>
  
  <pre><code>package edu.kit.tm.cm.bamsg.bffweb.iamservice;
  
  import org.springframework.security.core.GrantedAuthority;
  import org.springframework.security.core.authority.SimpleGrantedAuthority;
  import org.springframework.security.core.userdetails.UserDetailsService;
  import org.springframework.security.core.userdetails.UsernameNotFoundException;
  
  import java.util.HashSet;
  import java.util.Set;
  
  /*** @author schlund*/
  
  public class CustomStudentDetailsService implements UserDetailsService {
  
      private SecurityUserRepository securityUserRepository;
  
      public CustomStudentDetailsService(SecurityUserRepository userSecurityRepository){
          this.securityUserRepository=userSecurityRepository;
      }
  
  
      @Override
      public SecurityUser loadUserByUsername(String kitID) throws UsernameNotFoundException {
  
          try {
              SecurityUser securityPerson = securityUserRepository.findByUsername(kitID);
              if (securityPerson == null) {
                  return null;
              }
              return securityPerson;
          }
          catch (Exception e){
          throw new UsernameNotFoundException("User not found");
          }
      }
  
      private Set&lt;GrantedAuthority&gt; getAuthorities(SecurityUser securityPerson){
          Set&lt;GrantedAuthority&gt; authorities = new HashSet&lt;GrantedAuthority&gt;();
          GrantedAuthority grantedAuthority = new SimpleGrantedAuthority(securityPerson.getRole());
          authorities.add(grantedAuthority);
          return authorities;
      }
  
  }
  </code></pre>
  
  <p>This is my custom authentication provider:</p>
  
  <pre><code>package edu.kit.tm.cm.bamsg.bffweb.iamservice;
  
  import org.springframework.security.authentication.AuthenticationProvider;
  import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
  import org.springframework.security.core.Authentication;
  import org.springframework.security.core.AuthenticationException;
  import org.springframework.stereotype.Component;
  
  @Component
  public class CustomAuthenticationProvider implements AuthenticationProvider {
  
      public Authentication authenticate(Authentication authentication ) throws AuthenticationException {
          String password = authentication.getCredentials().toString().trim();
          SecurityUser appUser = new SecurityUser();
          return new UsernamePasswordAuthenticationToken(appUser, password, null);
    }
    @Override
    public boolean supports(Class&lt;? extends Object&gt; authentication) {
        return (UsernamePasswordAuthenticationToken.class.isAssignableFrom(authentication));
    }
  
  } 
  </code></pre>
  
  <p>This is my web security config:</p>
  
  <pre><code>package edu.kit.tm.cm.bamsg.bffweb;
  
  import org.springframework.beans.factory.annotation.Autowired;
  import org.springframework.boot.autoconfigure.security.oauth2.client.EnableOAuth2Sso;
  import org.springframework.cloud.security.oauth2.client.feign.OAuth2FeignRequestInterceptor;
  import org.springframework.context.annotation.Bean;
  import org.springframework.context.annotation.ComponentScan;
  import org.springframework.context.annotation.Configuration;
  import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
  import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
  import org.springframework.security.config.annotation.web.builders.HttpSecurity;
  import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
  import org.springframework.security.oauth2.client.OAuth2ClientContext;
  import org.springframework.security.oauth2.client.resource.OAuth2ProtectedResourceDetails;
  import org.springframework.security.web.authentication.www.BasicAuthenticationEntryPoint;
  import org.springframework.security.web.csrf.CookieCsrfTokenRepository;
  
  import edu.kit.tm.cm.bamsg.bffweb.iamservice.*;
  
  @Configuration
  @EnableOAuth2Sso
  @EnableGlobalMethodSecurity(prePostEnabled = true)
  @ComponentScan("edu.kit.tm.cm.bamsg.bffweb.iamservice")
  public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
  
      private static final String REALM = "bam";
  
      @Autowired
      private CustomAuthenticationProvider authProvider; 
  
      @Autowired
      @Override
      protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.authenticationProvider(authProvider);
      }
  
      @Override
      protected void configure(HttpSecurity http) throws Exception {
        http
              .logout()
              .and()
              //endpoints without authentication
              .authorizeRequests().antMatchers("/logged", "/userData").permitAll()
              .and()
              // default with authentication
              .authorizeRequests().anyRequest().authenticated()
              .and()
              .csrf()
              .csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse());
  }
  
      @Bean
      public OAuth2FeignRequestInterceptor oAuth2FeignRequestInterceptor(OAuth2ClientContext context, OAuth2ProtectedResourceDetails details) {
          return new OAuth2FeignRequestInterceptor(context, details);
      }
  
      @Bean
      BasicAuthenticationEntryPoint getBasicAuthEntryPoint() {
          BasicAuthenticationEntryPoint basicAuth = new BasicAuthenticationEntryPoint();
          basicAuth.setRealmName(REALM);
          return basicAuth;
      }
  }
  </code></pre>
  
  <p>And at least after authentication at the code line with the System.out.println the customized services should have been called, but unfortunatelly they are not. Breakpoints in the customized services have never been reached and the principal is still a string and not my customized user:</p>
  
  <pre><code>@ComponentScan("edu.kit.tm.cm.bamsg.bffweb.iamservice")
  @RestController
  @RequestMapping("/api/theses")
  public class ThesisController {
  
      @Autowired
      private ThesisClient thesisClient;
  
      @Autowired
      private ThesisPersonLinker linker;
  
      @Autowired
      private ThesisPersonFilter filter;
  
      @GetMapping
      @PreAuthorize("hasRole('theses')")
      public ResponseEntity&lt;Collection&lt;ThesisFrontendDTO&gt;&gt; findAllTheses() {
         System.out.println(SecurityContextHolder.getContext().getAuthentication().getPrincipal());
  </code></pre>
  
  <p>The extended user class looks like that:</p>
  
  <pre><code>package edu.kit.tm.cm.bamsg.bffweb.iamservice;
  
  import org.springframework.security.core.userdetails.User;
  
  
  public class SecurityUser extends User{
  
      String firstName;
      String name;
      String password;
  
      private static final long serialVersionUID = 1L;
  
      public SecurityUser() {
          super("user", "none", null);
          firstName = "Rainer";
          name = "Schlund";
          password = "meins";
      }
  
      public String getRole(){
          return "Student";
      }
  
  
  }
  </code></pre>
  
  <p>The code contains some simplifications for testing like SecurityPerson always returning the same person, but i think that should not be a problem.</p>