title: How to register a custom BasicAuthenticationFilter AuthenticationProvider in Spring Boot using Spring Security OAuth2
body: <h2>Context</h2>
  <p>I'm developing an application that allows an authenticated user to create <a href="https://www.rfc-editor.org/rfc/rfc6750#section-1.2" rel="nofollow noreferrer">OAuth2 bearer tokens</a> for use with APIs published by the organization. The idea is to allow the user to self generate / revoke such tokens, similar to GitHub's <a href="https://github.com/blog/1509-personal-api-tokens" rel="nofollow noreferrer">Personal API tokens</a>. The user can then use the issued tokens to gain programmatic access to protected resources. In this configuration, the OAuth &quot;Client&quot;, &quot;Authorization Server&quot; and the &quot;Resource Server&quot; belong to the organization. For now, all of these services reside in the same process.</p>
  <p>To this end, I'm trying support the <a href="https://www.rfc-editor.org/rfc/rfc6749#section-4.3" rel="nofollow noreferrer">Resource Owner Password Credentials Grant</a> type. The implementation environment consists of following:</p>
  <ul>
  <li>Spring Boot</li>
  <li>Spring Security OAuth2</li>
  </ul>
  <p>One constraint the implementation has is that is does not have access to the stored password. This processing is delegated to an internal web service which does the actual authentication.</p>
  <h2>Problem</h2>
  <p>Because of the constraint of not having access to the stored password, the default configured <code>DaoAuthenticationProvider</code> cannot be used since it requires access to the password provided by the <code>UserDetails</code> object returned by the provider's <code>UserDetailsService</code>.</p>
  <p>My guess is that I will need to replace this <code>AuthenticationProvider</code> with a custom implementation. However, all attempts at doing so seem to not take effect.</p>
  <p>The following seemed to register correctly in the <code>parent</code> reference of the <code>AuthenticationManager</code>, but is not delegated to at runtime (due the <code>DaoAuthenticationProvider</code> taking precedence):</p>
  <pre class="lang-java prettyprint-override"><code>@Configuration
  public class SecurityConfig extends GlobalAuthenticationConfigurerAdapter {
  
    @Override
    public void configure(AuthenticationManagerBuilder auth) throws Exception {
      auth.authenticationProvider(new AuthenticationProvider() {
  
        @Override
        public boolean supports(Class&lt;?&gt; authentication) {
          // For testing this is easier, but should check for UsernamePasswordAuthentication.class
          return true;
        }
  
        @Override
        public Authentication authenticate(Authentication authentication) throws AuthenticationException {
          // Perform custom logic...
          return authentication;
        }
  
      });
    }
  
  }
  </code></pre>
  <p>It seems no matter what I try (see references below) I always get the following two providers in <code>ProviderManager</code> when the <code>BasicAuthenticationFilter</code> invokes <code>Authentication authResult = authenticationManager.authenticate(authRequest)</code> in its <code>doFilter</code> method:</p>
  <p><code>[ org.springframework.security.authentication.AnonymousAuthenticationProvider@366815e4, org.springframework.security.authentication.dao.DaoAuthenticationProvider@5da3e311 ]</code></p>
  <p>I believe this may be a consequence of the <code>AuthorizationServerSecurityConfigurer</code>'s <code>clientCredentialsTokenEndpointFilter</code> method. However, this class is marked <code>final</code> and therefore cannot be customized.</p>
  <p>Any suggestions or pointers would be greatly appreciated.</p>
  <h2>Resources</h2>
  <p>Things that I have tried / researched:</p>
  <ul>
  <li><a href="http://projects.spring.io/spring-security-oauth/docs/oauth2.html#toc_7" rel="nofollow noreferrer">http://projects.spring.io/spring-security-oauth/docs/oauth2.html#toc_7</a></li>
  <li><a href="http://docs.spring.io/spring-boot/docs/current-SNAPSHOT/reference/htmlsingle/#howto-change-the-authenticationmanager-and-add-user-accounts" rel="nofollow noreferrer">http://docs.spring.io/spring-boot/docs/current-SNAPSHOT/reference/htmlsingle/#howto-change-the-authenticationmanager-and-add-user-accounts</a></li>
  <li><a href="https://stackoverflow.com/questions/20753979/spring-security-3-2-autowire-doesnt-work-with-java-configuration-and-custom-a">Spring Security 3.2: @Autowire doesn&#39;t work with java configuration and custom AuthenticationProvider in Spring MVC application?</a></li>
  <li><a href="https://stackoverflow.com/questions/21633555/how-to-inject-authenticationmanager-using-java-configuration-in-a-custom-filter">How To Inject AuthenticationManager using Java Configuration in a Custom Filter</a></li>
  <li><a href="https://stackoverflow.com/questions/22606751/custom-authentication-provider-with-spring-security-and-java-config">Custom Authentication provider with Spring Security and Java Config</a></li>
  <li><a href="https://gist.github.com/SlyDen/9408539" rel="nofollow noreferrer">https://gist.github.com/SlyDen/9408539</a>
  -https://github.com/royclarkson/spring-rest-service-oauth/blob/master/src/main/java/hello/WebSecurityConfiguration.java</li>
  <li><a href="https://github.com/spring-projects/spring-boot/blob/master/spring-boot-samples/spring-boot-sample-web-secure/src/main/java/sample/ui/secure/SampleWebSecureApplication.java" rel="nofollow noreferrer">https://github.com/spring-projects/spring-boot/blob/master/spring-boot-samples/spring-boot-sample-web-secure/src/main/java/sample/ui/secure/SampleWebSecureApplication.java</a></li>
  <li><a href="https://github.com/spring-projects/spring-security-oauth/blob/master/samples/oauth2/sparklr/src/main/java/org/springframework/security/oauth/examples/sparklr/config/OAuth2ServerConfig.java" rel="nofollow noreferrer">https://github.com/spring-projects/spring-security-oauth/blob/master/samples/oauth2/sparklr/src/main/java/org/springframework/security/oauth/examples/sparklr/config/OAuth2ServerConfig.java</a></li>
  <li><a href="https://github.com/spring-projects/spring-security-oauth/blob/6d9de66787cb60249f0de00ffe9075366a803924/tests/annotation/vanilla/src/main/java/demo/Application.java" rel="nofollow noreferrer">https://github.com/spring-projects/spring-security-oauth/blob/6d9de66787cb60249f0de00ffe9075366a803924/tests/annotation/vanilla/src/main/java/demo/Application.java</a></li>
  <li><a href="https://github.com/spring-projects/spring-security-javaconfig/blob/master/samples/oauth2-sparklr/src/main/java/org/springframework/security/oauth/examples/sparklr/config/SecurityConfiguration.java" rel="nofollow noreferrer">https://github.com/spring-projects/spring-security-javaconfig/blob/master/samples/oauth2-sparklr/src/main/java/org/springframework/security/oauth/examples/sparklr/config/SecurityConfiguration.java</a></li>
  </ul>