why does spring security oauth2 authorization server keep calling UserDetailsService? - spring

Question

Get access token through password grant type, why does authorization server keep calling UserDetailsService when user password is wrong
2021-01-19 20:41:29.801 DEBUG 38781 --- [nio-9007-exec-1] o.s.s.w.a.i.FilterSecurityInterceptor : Authorization successful
2021-01-19 20:41:29.801 DEBUG 38781 --- [nio-9007-exec-1] o.s.s.w.a.i.FilterSecurityInterceptor : RunAsManager did not change Authentication object
2021-01-19 20:41:29.801 DEBUG 38781 --- [nio-9007-exec-1] o.s.security.web.FilterChainProxy : /oauth/token reached end of additional filter chain; proceeding with original chain
2021-01-19 20:41:29.807 DEBUG 38781 --- [nio-9007-exec-1] o.s.web.servlet.DispatcherServlet : POST "/oauth/token", parameters={masked}
2021-01-19 20:41:29.817 DEBUG 38781 --- [nio-9007-exec-1] .s.o.p.e.FrameworkEndpointHandlerMapping : Mapped to org.springframework.security.oauth2.provider.endpoint.TokenEndpoint#postAccessToken(Principal, Map)
2021-01-19 20:41:30.292 DEBUG 38781 --- [nio-9007-exec-1] o.s.s.a.dao.DaoAuthenticationProvider : Authentication failed: password does not match stored value
2021-01-19 20:41:30.297 DEBUG 38781 --- [nio-9007-exec-1] o.s.s.authentication.ProviderManager : Authentication attempt using org.springframework.security.authentication.dao.DaoAuthenticationProvider
2021-01-19 20:41:30.297 DEBUG 38781 --- [nio-9007-exec-1] o.s.jdbc.datasource.DataSourceUtils : Fetching JDBC Connection from DataSource
2021-01-19 20:41:30.302 DEBUG 38781 --- [nio-9007-exec-1] o.s.jdbc.datasource.DataSourceUtils : Fetching JDBC Connection from DataSource
2021-01-19 20:41:30.306 DEBUG 38781 --- [nio-9007-exec-1] o.s.jdbc.datasource.DataSourceUtils : Fetching JDBC Connection from DataSource
2021-01-19 20:41:30.425 DEBUG 38781 --- [nio-9007-exec-1] o.s.s.a.dao.DaoAuthenticationProvider : Authentication failed: password does not match stored value
2021-01-19 20:41:30.425 DEBUG 38781 --- [nio-9007-exec-1] o.s.s.authentication.ProviderManager : Authentication attempt using org.springframework.security.authentication.dao.DaoAuthenticationProvider
2021-01-19 20:41:30.426 DEBUG 38781 --- [nio-9007-exec-1] o.s.jdbc.datasource.DataSourceUtils : Fetching JDBC Connection from DataSource
2021-01-19 20:41:30.431 DEBUG 38781 --- [nio-9007-exec-1] o.s.jdbc.datasource.DataSourceUtils : Fetching JDBC Connection from DataSource
2021-01-19 20:41:30.435 DEBUG 38781 --- [nio-9007-exec-1] o.s.jdbc.datasource.DataSourceUtils : Fetching JDBC Connection from DataSource
Hope is to prompt that the password is wrong.
My UserDetailsService is:
#Service
public class MyUserDetailsService implements UserDetailsService {
#Autowired
private UserMapper userMapper;
#Override
public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
User user = userMapper.selectByUserName(username);
User userRoles = userMapper.selectRolesById(user.getId());
List<String> roles = userRoles.getRoles().stream().map(Role::getRole).collect(Collectors.toList());
User userResourcePermissions = userMapper.selectResourcePermissionsById(user.getId());
List<String> resourcePermissions = userResourcePermissions.getResourcePermissions().stream()
.map(roleResourcePermissionRef -> String.format("%s:%s",roleResourcePermissionRef.getResourceCode(),roleResourcePermissionRef.getPermissionCode()))
.collect(Collectors.toList());
resourcePermissions.add("a1");
UserDetails userDetails = org.springframework.security.core.userdetails.User
.withUsername(user.getUserName())
.password(user.getPassword())
.roles(roles.toArray(new String[0]))
.authorities(resourcePermissions.toArray(new String[0]))
.build();
return userDetails;
}
}
#Configuration
#EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {
#Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
auth.userDetailsService(myUserDetailsService)
.passwordEncoder(passwordEncoder)
// .and().parentAuthenticationManager(authenticationManagerBean())
;
}
}
Caused by the .and().parentAuthenticationManager(authenticationManagerBean()) .

Answer 1

Because it has to get the user details in order to check the password.
if (!this.passwordEncoder.matches(presentedPassword, userDetails.getPassword())) {
this.logger.debug("Failed to authenticate since password does not match stored value");
throw new BadCredentialsException(this.messages
.getMessage("AbstractUserDetailsAuthenticationProvider.badCredentials", "Bad credentials"));
}
o.s.s.a.dao.DaoAuthenticationProvider.java:76