Spring Security 5 programatically validate a username and password - spring-boot

Question

I have a grails 5 Spring Security app (that i've recently migrated from grails 3). Spring Security 4+ uses a different password scheme where it includes the algorithm, salt and hashed password all in the password field delimited like so: "{algorithm}{salt}{hash}"
This all works fine. I've appended "{SHA-256}" to the start of existing passwords, and authentication is working for the web app.
The problem is that I have an API section of my app that uses basic auth which I manually authenticate in my controllers (not using spring security). This is simple and stateless and works well for my purposes. Problem is, I can no longer validate usernames and passwords when I create new users which Spring Security adds a salt for.
Old code that worked before adding salt to new users was effectively:
String sha256hex = DigestUtils.sha256Hex(password);
String dbHashedPw = "{SHA-256}${sha256hex}"
user = User.findByUsernameAndPassword(email, dbHashedPw)
This doesn't handle salt, or iterations, so does not work on passwords generated for new users.
I've tried enabling grails.plugin.springsecurity.useBasicAuth: true (in application.yml) but this perhaps was misconfigured since it seemed to have no effect.
I've also tried improving my code above to work with the salt and iterating in the same manner as Spring Security does, but it becomes complicated and doesn't seem like the best way to do it.
What I want is an interface like:
boolean springSecurityService.validatePassword(UserDetails userDetails, String password)
Where Spring Security would grab the password from the database and use the markup describing the algorithm and the salt, and do the appropriate hashing on password and compare the two, returning a boolean if the password matches.
It seems like this should be simple, but I've now spent over a full day hacking around it with no success. Any help would be appreciated!

Answer 1

Answering my own question with a workaround I've found. I couldn't find the springSecurityService interface that I wanted, but I did find I could emulate the old grails 3 password encoding by not calling spring security in User.groovy, and instead doing the following:
import org.apache.commons.codec.digest.DigestUtils
...
def beforeInsert() {
encodePassword()
}
def beforeUpdate() {
if (isDirty('password')) {
encodePassword()
}
}
protected void encodePassword() {
password = "{SHA-256}" + DigestUtils.sha256Hex(password)
}
Note I'm relying on apache library: 'commons-codec:commons-codec:1.11' to do the hash.
Of course, it should be mentioned that SHA-256 is not considered secure any more and this is only for backwards compatibility before a migration is possible.