Question

I have configured two authentication providers in my Spring Security config:

   <security:authentication-manager>
      <security:authentication-provider ref="XProvider" />
      <security:authentication-provider ref="YProvider" />
   </security:authentication-manager>

Does spring security evaluate both providers? Or does it stop to evaluate if one of them fails? If not, How to make it stop?

Thanks.

Answer 1

You can specify as many providers as you want. They will be checked in the same order you declared them inside the authentication-manager tag.

Once a successful authentication is made, it will stop polling the providers. If any provider throws an AccountStatusException it will also break the polling.