title: Spring Security authentication with more then one user in DB doesn't work
body: <p>Spring Security 3.0 + PostgreSql</p>
  
  <p>When I create first user and after i login the authentication works fine.</p>
  
  <p><strong>The issue:</strong> After I create another user and i try to login i get the validation errors that username or password are wrong;</p>
  
  <p>This is the xml config :</p>
  
  <pre><code>&lt;b:beans xmlns="http://www.springframework.org/schema/security"
      xmlns:b="http://www.springframework.org/schema/beans"
      xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
      xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
                          http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.0.xsd"&gt;
  
      &lt;global-method-security pre-post-annotations="enabled"&gt;
          &lt;expression-handler ref="expressionHandler"/&gt;
      &lt;/global-method-security&gt;
  
      &lt;http realm="Facebook"&gt; 
          &lt;intercept-url pattern="/login" access="IS_AUTHENTICATED_ANONYMOUSLY"/&gt;
           &lt;intercept-url pattern="/register" access="IS_AUTHENTICATED_ANONYMOUSLY"/&gt;
          &lt;intercept-url pattern="/**" access="ROLE_USER"/&gt;
  
          &lt;form-login login-page="/login" authentication-failure-url="/login?login_error=1"/&gt;
          &lt;http-basic/&gt;
          &lt;logout /&gt;
          &lt;custom-filter ref="switchUserProcessingFilter" position="SWITCH_USER_FILTER"/&gt;
      &lt;/http&gt;
  
      &lt;b:bean id="daoAuthenticationProvider"
          class="org.springframework.security.authentication.dao.DaoAuthenticationProvider"&gt;
          &lt;!-- b:property name="saltSource" ref="saltSource"/&gt;
          &lt;b:property name="passwordEncoder" ref="passwordEncoder"/&gt; --&gt;
          &lt;b:property name="userDetailsService" ref="userDetailsService"/&gt;
      &lt;/b:bean&gt;
  
      &lt;b:bean id="authenticationManager"
          class="org.springframework.security.authentication.ProviderManager"&gt;
        &lt;b:property name="providers"&gt;
          &lt;b:list&gt;
            &lt;b:ref local="daoAuthenticationProvider" /&gt;
          &lt;/b:list&gt;
        &lt;/b:property&gt;
      &lt;/b:bean&gt;
  
      &lt;authentication-manager&gt;
        &lt;authentication-provider user-service-ref="userDetailsService"&gt;
          &lt;password-encoder hash="md5"/&gt;
        &lt;/authentication-provider&gt;
      &lt;/authentication-manager&gt;
  
  
  
  
      &lt;b:bean id="loggerListener" class="org.springframework.security.authentication.event.LoggerListener"/&gt;
  
  
      &lt;b:bean id="switchUserProcessingFilter" class="org.springframework.security.web.authentication.switchuser.SwitchUserFilter" autowire="byType"&gt;
         &lt;b:property name="targetUrl" value="/secure/index.htm"/&gt;
      &lt;/b:bean&gt;
  
      &lt;b:bean id="expressionHandler" class="org.springframework.security.access.expression.method.DefaultMethodSecurityExpressionHandler"&gt;
          &lt;b:property name="permissionEvaluator" ref="permissionEvaluator"/&gt;
      &lt;/b:bean&gt;
  
      &lt;b:bean id="permissionEvaluator" class="org.springframework.security.acls.AclPermissionEvaluator"&gt;
          &lt;b:constructor-arg ref="aclService"/&gt;
      &lt;/b:bean&gt;
  
  &lt;/b:beans&gt; 
  </code></pre>
  
  <p><strong>This is the LOGGER output:</strong> </p>
  
  <pre><code>2011-12-19 17:45:50,545 DEBUG [org.springframework.security.web.access.ExceptionTranslationFilter] - &lt;Chain processed normally&gt;
  2011-12-19 17:45:50,545 DEBUG [org.springframework.security.web.context.HttpSessionSecurityContextRepository] - &lt;SecurityContext contents are anonymous - c
  ontext will not be stored in HttpSession. &gt;
  2011-12-19 17:45:50,558 DEBUG [org.springframework.security.web.context.SecurityContextPersistenceFilter] - &lt;SecurityContextHolder now cleared, as request
  processing completed&gt;
  2011-12-19 17:46:06,668 DEBUG [org.springframework.security.web.FilterChainProxy] - &lt;Converted URL to lowercase, from: '/j_spring_security_check'; to: '/j_
  spring_security_check'&gt;
  2011-12-19 17:46:06,669 DEBUG [org.springframework.security.web.FilterChainProxy] - &lt;Candidate is: '/j_spring_security_check'; pattern is /**; matched=true
  &gt;
  2011-12-19 17:46:06,669 DEBUG [org.springframework.security.web.FilterChainProxy] - &lt;/j_spring_security_check at position 1 of 11 in additional filter chai
  n; firing Filter: 'org.springframework.security.web.context.SecurityContextPersistenceFilter@7f69378d'&gt;
  2011-12-19 17:46:06,670 DEBUG [org.springframework.security.web.context.HttpSessionSecurityContextRepository] - &lt;HttpSession returned null object for SPRIN
  G_SECURITY_CONTEXT&gt;
  2    011-12-19 17:46:06,670 DEBUG [org.springframework.security.web.context.HttpSessionSecurityContextRepository] - &lt;No SecurityContext was available from the
  HttpSession: org.apache.catalina.session.StandardSessionFacade@ec139fb. A new one will be created.&gt;
  2011-12-19 17:46:06,671 DEBUG [org.springframework.security.web.FilterChainProxy] - &lt;/j_spring_security_check at position 2 of 11 in additional filter chai
  n; firing Filter: 'org.springframework.security.web.authentication.logout.LogoutFilter@47568bde'&gt;
  2011-12-19 17:46:06,671 DEBUG [org.springframework.security.web.FilterChainProxy] - &lt;/j_spring_security_check at position 3 of 11 in additional filter chai
  n; firing Filter: 'org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter@2f8c069'&gt;
  2011-12-19 17:46:06,672 DEBUG [org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter] - &lt;Request is to process authenticatio
  n&gt;
  2011-12-19 17:46:06,672 DEBUG [org.springframework.security.authentication.ProviderManager] - &lt;Authentication attempt using org.springframework.security.au
  thentication.dao.DaoAuthenticationProvider&gt;
  Hibernate: select user0_.id as id2_, user0_.active as active2_, user0_.avatarLocation as avatarLo3_2_, user0_.registration_date as registra4_2_, user0_.ema
  il as email2_, user0_.name as name2_, user0_.password as password2_, user0_.surname as surname2_, user0_.username as username2_ from Member user0_ limit ?
  Hibernate: select wallposts0_.author_id as author2_2_1_, wallposts0_.id as id1_, wallposts0_.id as id1_0_, wallposts0_.author_id as author2_1_0_, wallposts
  0_.creationDate as creation3_1_0_ from WallPost wallposts0_ where wallposts0_.author_id=?
  Hibernate: select mesaje0_.author_id as author2_2_1_, mesaje0_.id as id1_, mesaje0_.id as id3_0_, mesaje0_.author_id as author2_3_0_, mesaje0_.content as c
  ontent3_0_, mesaje0_.receiver_Id as receiver4_3_0_, mesaje0_.subject as subject3_0_, mesaje0_.wall_post_id as wall6_3_0_ from Message mesaje0_ where mesaje
  0_.author_id=?
  Hibernate: select authoritie0_.id as id2_1_, authoritie0_.authority_Id as authority2_1_, authority1_.authority_Id as authority1_4_0_, authority1_.authority
   as authority4_0_ from Member_Authorities authoritie0_ inner join Authorities authority1_ on authoritie0_.authority_Id=authority1_.authority_Id where autho
  ritie0_.id=?
  Hibernate: select wallposts0_.author_id as author2_2_1_, wallposts0_.id as id1_, wallposts0_.id as id1_0_, wallposts0_.author_id as author2_1_0_, wallposts
  0_.creationDate as creation3_1_0_ from WallPost wallposts0_ where wallposts0_.author_id=?
  Hibernate: select mesaje0_.author_id as author2_2_1_, mesaje0_.id as id1_, mesaje0_.id as id3_0_, mesaje0_.author_id as author2_3_0_, mesaje0_.content as c
  ontent3_0_, mesaje0_.receiver_Id as receiver4_3_0_, mesaje0_.subject as subject3_0_, mesaje0_.wall_post_id as wall6_3_0_ from Message mesaje0_ where mesaje
  0_.author_id=?
  Hibernate: select authoritie0_.id as id2_1_, authoritie0_.authority_Id as authority2_1_, authority1_.authority_Id as authority1_4_0_, authority1_.authority
   as authority4_0_ from Member_Authorities authoritie0_ inner join Authorities authority1_ on authoritie0_.authority_Id=authority1_.authority_Id where autho
  ritie0_.id=?
  2011-12-19 17:46:06,836 WARN [org.springframework.security.authentication.event.LoggerListener] - &lt;Authentication event AuthenticationFailureServiceExcepti
  onEvent: gogu; details: org.springframework.security.web.authentication.WebAuthenticationDetails@957e: RemoteIpAddress: 127.0.0.1; SessionId: 7A08BE43A052A
  757AD35DB97351167A7; exception: result returns more than one elements&gt;
  2011-12-19 17:46:06,837 DEBUG [org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter] - &lt;Authentication request failed: org.
  springframework.security.authentication.AuthenticationServiceException: result returns more than one elements&gt;
  2011-12-19 17:46:06,838 DEBUG [org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter] - &lt;Updated SecurityContextHolder to co
  ntain null Authentication&gt;
  2011-12-19 17:46:06,838 DEBUG [org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter] - &lt;Delegating to authentication failur
  e handlerorg.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler@fdb5ed9&gt;
  2011-12-19 17:46:06,839 DEBUG [org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler] - &lt;Redirecting to /login?login_error=
  1&gt;
  2011-12-19 17:46:06,839 DEBUG [org.springframework.security.web.DefaultRedirectStrategy] - &lt;Redirecting to '/facebook-1.0.0-SNAPSHOT/login?login_error=1'&gt;
  2011-12-19 17:46:06,839 DEBUG [org.springframework.security.web.context.SecurityContextPersistenceFilter] - &lt;SecurityContextHolder now cleared, as request
  processing completed&gt;
  2011-12-19 17:46:06,842 DEBUG [org.springframework.security.web.FilterChainProxy] - &lt;Converted URL to lowercase, from: '/login'; to: '/login'&gt;
  2011-12-19 17:46:06,842 DEBUG [org.springframework.security.web.FilterChainProxy] - &lt;Candidate is: '/login'; pattern is /**; matched=true&gt;
  2011-12-19 17:46:06,843 DEBUG [org.springframework.security.web.FilterChainProxy] - &lt;/login?login_error=1 at position 1 of 11 in additional filter chain; f
  iring Filter: 'org.springframework.security.web.context.SecurityContextPersistenceFilter@7f69378d'&gt;
  2011-12-19 17:46:06,843 DEBUG [org.springframework.security.web.context.HttpSessionSecurityContextRepository] - &lt;HttpSession returned null object for SPRING_SECURITY_CONTEXT&gt;
  </code></pre>
  
  <p>thanks!</p>
  
  <hr>
  
  <p>thanks Jon ! Yes my UserDetailsServiceImpl has an issue because when i use the  <code>&lt;jdbc-user-service data-source ref="myDataSource"/&gt;</code> it works fine. </p>
  
  <p>UserDetailsServiceImpl - loadUserByUsername(username) :</p>
  
  <p>import org.springframework.security.core.userdetails.User;</p>
  
  <p>.... .. . .. . .</p>
  
  <pre><code>    @Override
      @Transactional(readOnly = true) 
  public UserDetails loadUserByUsername(String username)
          throws UsernameNotFoundException, DataAccessException {
      org.myapp.app.domain.User userEntity = userDao.getUserByName(username);
      if (userEntity == null)
        throw new UsernameNotFoundException("user not found");
      String password = userEntity.getPassword();
      Set&lt;Authority&gt; authorities = userEntity.getAuthorities();
      Collection&lt;GrantedAuthority&gt; grantedAuthorities = new ArrayList&lt;GrantedAuthority&gt;();
       for (Authority authority : authorities) {
           grantedAuthorities.add(new GrantedAuthorityImpl(authority.getAuthority()));
      }  
      return new User(username, password, true, true, true, true, grantedAuthorities);
  </code></pre>
  
  <p>had anyone similar issues with the UserDetailsServiceImpl and can give a hint</p>