title: JWT Authentication fails: Bad Credentials
body: <p>I am using <code>Spring boot 2.1.3</code> with JWT authentication.</p>
  
  <p>the reference link is <a href="https://www.callicoder.com/spring-boot-spring-security-jwt-mysql-react-app-part-2/" rel="nofollow noreferrer">https://www.callicoder.com/spring-boot-spring-security-jwt-mysql-react-app-part-2/</a></p>
  
  <pre><code>@SpringBootApplication
  public class LrimspublicApplication extends SpringBootServletInitializer implements CommandLineRunner
  {
  @Autowired
  private PasswordEncoder passwordEncoder;
  
  
  public static void main(String[] args) {
      SpringApplication.run(LrimspublicApplication.class, args);
  }
  
  
  @Override
  protected SpringApplicationBuilder configure(SpringApplicationBuilder application) {
      return application.sources(LrimspublicApplication.class);
  }
  
  
  @Override
  public void run(String... args) throws Exception {
      System.out.println(passwordEncoder.encode("devil@123"));
  }
  </code></pre>
  
  <p>}</p>
  
  <p><strong>SpringSecurityConfig.java</strong></p>
  
  <pre><code>@Configuration
  @EnableWebSecurity
  @EnableGlobalMethodSecurity(
          securedEnabled = true,
          jsr250Enabled = true,
          prePostEnabled = true
  )
  public class SecurityConfig extends WebSecurityConfigurerAdapter {
  
      @Autowired
      CustomUserDetailsService customUserDetailsService;
  
      @Autowired
      private JwtAuthenticationEntryPoint unauthorizedHandler;
  
      @Bean
      public JwtAuthenticationFilter jwtAuthenticationFilter() {
          return new JwtAuthenticationFilter();
      }
  
      @Override
      public void configure(AuthenticationManagerBuilder authenticationManagerBuilder) throws Exception {
          authenticationManagerBuilder
                  .userDetailsService(customUserDetailsService)
                  .passwordEncoder(passwordEncoder());
      }
  
      @Bean(BeanIds.AUTHENTICATION_MANAGER)
      @Override
      public AuthenticationManager authenticationManagerBean() throws Exception {
          return super.authenticationManagerBean();
      }
  
      @Bean
      public PasswordEncoder passwordEncoder() {
          return PasswordEncoderFactories.createDelegatingPasswordEncoder();
      }
  
      @Override
      protected void configure(HttpSecurity http) throws Exception {
          http
                  .cors()
                      .and()
                  .csrf()
                      .disable()
                  .exceptionHandling()
                      .authenticationEntryPoint(unauthorizedHandler)
                      .and()
                  .sessionManagement()
                      .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
                      .and()
                  .authorizeRequests()
                      .antMatchers("/",
                          "/favicon.ico",
                          "/**/*.png",
                          "/**/*.gif",
                          "/**/*.svg",
                          "/**/*.jpg",
                          "/**/*.html",
                          "/**/*.css",
                          "/**/*.js")
                          .permitAll()
                      .antMatchers("/api/auth/**")
                          .permitAll()
                  .antMatchers("/app/**").permitAll()
                      .antMatchers("/api/user/checkUsernameAvailability", "/api/user/checkEmailAvailability")
                          .permitAll()
                      .antMatchers(HttpMethod.GET, "/api/polls/**", "/api/users/**")
                          .permitAll()
                      .anyRequest()
                          .authenticated();
  
          // Add our custom JWT security filter
          http.addFilterBefore(jwtAuthenticationFilter(), UsernamePasswordAuthenticationFilter.class);
  
      }
  </code></pre>
  
  <p>and now i am creating new user using a post API which looks like this</p>
  
  <pre><code>@RequestMapping(value = "/app/user/create", method = RequestMethod.POST)
      @ResponseBody
      public  Tbluser createUser(HttpServletRequest request, HttpServletResponse response) throws ParseException{
  
      String district="";
      String office=null;
      String gender="";
      String firstName="";                
      String middleName="";
      String lastName="";
      String  mobileNumber="";
      String emailID="";
      String dateOfBirth="";
      String address="";
      String userName="";
      String password="";
      String employeeId="";
      List&lt;Tbluser&gt; users=null;
      Tbluser user=new Tbluser();
      String encryptedPassword="";
      DateFormat df = new SimpleDateFormat("yyyy-MM-dd");
      DateFormat dateformatter = new SimpleDateFormat("dd-MM-yyyy");
      Date dt_dateOfBirth = null;
      Tblrole role=new Tblrole();
      //String userTypeId="Official";
      String userTypeId="4";
      String active="1";
      String description="";
      Date createdDate;
      String createdBY=""; 
      String userId="";
      String newUserRole="";
      String secretcode="";
      String firstNameNepali="";
      String middleNameNepali ="";
      String lastNameNepali = "";
  
      try {
          try{district = ServletRequestUtils.getRequiredStringParameter(request, "ddlAddUserDistrict");}catch(Exception ex){}
          try{office = ServletRequestUtils.getRequiredStringParameter(request, "ddlAddUserOffice");}catch(Exception ex){}         
          try{gender=ServletRequestUtils.getRequiredStringParameter(request, "ddlAddUserGender");}catch(Exception ex){}           
          try{firstName=ServletRequestUtils.getRequiredStringParameter(request, "txtAddUserUserFirstName");}catch(Exception ex){}         
          try{middleName = ServletRequestUtils.getRequiredStringParameter(request, "txtAddUserUserMiddleName");}catch(Exception ex){}
          try{lastName = ServletRequestUtils.getRequiredStringParameter(request, "txtAddUserUserLastName");   }catch(Exception ex){}
          try{mobileNumber = ServletRequestUtils.getRequiredStringParameter(request, "txtAddUserMobileNumber");}catch(Exception ex){}
          try{emailID = ServletRequestUtils.getRequiredStringParameter(request, "txtAddUserEmailID"); }catch(Exception ex){}          
          try{dateOfBirth = ServletRequestUtils.getRequiredStringParameter(request, "hidUserDateOfBirth");}catch(Exception ex){}          
          try{address = ServletRequestUtils.getRequiredStringParameter(request, "txtAddUserAddress"); }catch(Exception ex){}                              
          try{userName = ServletRequestUtils.getRequiredStringParameter(request, "txtAddUserUserName");}catch(Exception ex){}
          try{password = ServletRequestUtils.getRequiredStringParameter(request, "txtAddUserPassword");}catch(Exception ex){}
          try{employeeId = ServletRequestUtils.getRequiredStringParameter(request, "txtAddUserEmployeeId");}catch(Exception ex){}                             
          try{secretcode= ServletRequestUtils.getRequiredStringParameter(request, "txtAddUserSecretCode");}catch(Exception ex){}
          if (!dateOfBirth.isEmpty() &amp;&amp; dateOfBirth!=null)
              {
                  //dt_dateOfBirth = df.parse(dateOfBirth); 
                  dt_dateOfBirth = dateformatter.parse(dateOfBirth); 
              }   
          try{description = ServletRequestUtils.getRequiredStringParameter(request, "txtAddUserDescription"); }catch(Exception ex){}      
          try{createdBY= ServletRequestUtils.getRequiredStringParameter(request, "hid-createdBy");}catch(Exception ex){}  
          try{userId=ServletRequestUtils.getRequiredStringParameter(request, "hid-userId");}catch(Exception ex){}
          try{newUserRole=ServletRequestUtils.getRequiredStringParameter(request, "user_roles");}catch(Exception ex){}    
  
          try{firstNameNepali=ServletRequestUtils.getRequiredStringParameter(request, "txtAddUserUserFirstNameNepali");}catch(Exception ex){}         
          try{middleNameNepali = ServletRequestUtils.getRequiredStringParameter(request, "txtAddUserUserMiddleNameNepali");}catch(Exception ex){}
          try{lastNameNepali = ServletRequestUtils.getRequiredStringParameter(request, "txtAddUserUserLastNameNepali");}catch(Exception ex){}
  
  
  
          //*To save Biometric and Image data*//*
          try{
              String imagedata = ServletRequestUtils.getRequiredStringParameter(request, "imagedataForSeller");
              String leftthumbimage = ServletRequestUtils.getRequiredStringParameter(request, "hidUserInformationLeftThumbImpressionImage");
              String leftthumbdata = ServletRequestUtils.getRequiredStringParameter(request, "hidUserInformationLeftThumbImpressionData");
              String rightthumbimage = ServletRequestUtils.getRequiredStringParameter(request, "hidUserInformationRightThumbImpressionImage");
              String rightthumbdata  = ServletRequestUtils.getRequiredStringParameter(request, "hidUserInformationRightThumbImpressionData");
              String signaturedata  = ServletRequestUtils.getRequiredStringParameter(request, "hidOldSellerSignatureImage");
  
              if(user.getSignature() == null || user.getSignature().length &lt; 1)
              {
                  signaturedata  = ServletRequestUtils.getRequiredStringParameter(request, "hidNewSellerSignatureImage");
              }
  
  
  
              user.setLeftthumbimpression(org.apache.commons.codec.binary.Base64.decodeBase64(leftthumbimage.getBytes()));
              user.setLeftthumbimpressiondata(leftthumbdata.getBytes(Charset.forName("UTF-8")));
              user.setRightthumbimpression(org.apache.commons.codec.binary.Base64.decodeBase64(rightthumbimage.getBytes()));
              user.setRightthumbimpressiondata(rightthumbdata.getBytes(Charset.forName("UTF-8")));
              user.setPhoto(org.apache.commons.codec.binary.Base64.decodeBase64(imagedata.getBytes()));
          }
          catch(Exception ex){}
  
          try{user.setTbldistrict(districtService.findDistirctById(Long.parseLong(district)));}catch(Exception ex){}
          try{user.setTbloffice(officeService.findOfficeById(Long.parseLong(office)));}catch(Exception ex){}
          try{user.setTblgender(genderService.findGenderById(Long.parseLong(gender)));}catch(Exception ex){}
          try{user.setAddress(address);}catch(Exception ex){}
          try{user.setUsername(userName);}catch(Exception ex){}
          try{user.setPassword(passwordEncoder.encode(password));}catch (Exception ex){}
  
          role=roleService.findRoleByID(Long.parseLong(newUserRole));
  
          //*  Role mapping *//*
  
              Set&lt;Tblrole&gt; roleSet = new HashSet&lt;Tblrole&gt;();
              roleSet.add(role);
              user.setTblroles(roleSet);
  
              user= userService.saveUser(user);
  } catch(Exception ex){
              logger.error(ex);
          }
          return user;
  
      }
  </code></pre>
  
  <p>The user create api successfully creates/inserts the user into database. now when i try to login it fails and says bad credentials:</p>
  
  <p>my login controller is </p>
  
  <pre><code>@PostMapping("/signin")
      public ResponseEntity&lt;?&gt; authenticateUser(@Valid @RequestBody LoginRequest loginRequest) {
  
          Authentication authentication = authenticationManager.authenticate(
                  new UsernamePasswordAuthenticationToken(
                          loginRequest.getUsernameOrEmail(),
                          loginRequest.getPassword()
                  )
          );
  
          //Tbluser user = userRepository.findByUsername(loginRequest.getUsernameOrEmail());
          Optional&lt;Tbluser&gt; user = userRepository.findByUsername(loginRequest.getUsernameOrEmail());
  
          Tbluser u = new Tbluser();
          if(user.isPresent()){
              u = user.get();
          }
  
          Tbluser uu =new Tbluser() ;
  //        UserPojo userPojo =
  
          Map&lt;String ,Object&gt; map = new HashMap&lt;&gt;();
          Set&lt;Tblrole&gt; roleList = uu.getTblroles();
  
  
          SecurityContextHolder.getContext().setAuthentication(authentication);
  
          UserPrincipal userPrincipal = (UserPrincipal) authentication.getPrincipal();
  
          String accessToken = tokenProvider.generateToken(authentication);
          String refreshToken = tokenProvider.generateRefreshToken();
  
          //saveRefreshToken(userPrincipal, refreshToken);
  
          StringBuilder builder = new StringBuilder();
          String combinedToken =builder.append(accessToken).append(",").append(refreshToken).toString();
  
          return ResponseEntity.ok().header("Authorization",combinedToken).body(map);
      }
  </code></pre>
  
  <p>UPDATED:-</p>
  
  <pre><code>@Service
  public class CustomUserDetailsService implements UserDetailsService {
  
      @Autowired
      UserRepository userRepository;
  
      @Override
      @Transactional
      public UserDetails loadUserByUsername(String usernameOrEmail)
              throws UsernameNotFoundException {
          // Let people login with either username or email
          Tbluser user = userRepository.findByUsername(usernameOrEmail)
                  .orElseThrow(() -&gt;
                          new UsernameNotFoundException("User not found with username or email : " + usernameOrEmail)
          );
  
          return UserPrincipal.create(user);
      }
  
      @Transactional
      public UserDetails loadUserById(Long id) {
          Tbluser user = userRepository.findById(id).orElseThrow(
              () -&gt; new ResourceNotFoundException("User", "id", id)
          );
  
          return UserPrincipal.create(user);
      }
  }
  </code></pre>
  
  <p>and UserPrincipal is:-</p>
  
  <pre><code>public class UserPrincipal implements UserDetails {
      private Long id;
  
      private String name;
  
      private String username;
  
      @JsonIgnore
      private String email;
  
      @JsonIgnore
      private String password;
  
      private Collection&lt;? extends GrantedAuthority&gt; authorities;
  
      public UserPrincipal(Long id, String name, String username, String email, String password, Collection&lt;? extends GrantedAuthority&gt; authorities) {
          this.id = id;
          this.name = name;
          this.username = username;
          this.email = email;
          this.password = password;
          this.authorities = authorities;
      }
  
      public static UserPrincipal create(Tbluser user) {
          List&lt;GrantedAuthority&gt; authorities = user.getTblroles().stream().map(role -&gt;
                  new SimpleGrantedAuthority(role.getRolename())
          ).collect(Collectors.toList());
  
          return new UserPrincipal(
                  user.getUserid(),
                  user.getFirstname(),
                  user.getUsername(),
                  user.getEmailid(),
                  user.getPassword(),
                  authorities
          );
      }
  
  //getter setter excluded
  }
  </code></pre>
  
  <p>now the interesting part is whenever i replace my password in database with the password generated on console (from commandlinerunner implementation) it successfully generates token.</p>
  
  <p>and now when i see /app/create/user api to create user i see nothing wrong in creating the user. </p>
  
  <p>what have i been missing ? pointing an error will really be a massive help to me.</p>