title: How to implement customized SHA-256 salt per user login/out with db spring 3.1 security?
body: <p>I am reading the doc <a href="http://static.springsource.org/spring-security/site/docs/3.1.x/reference/springsecurity-single.html" rel="nofollow">Spring 3.1 security documentation</a> extensively, but I can't find answers to all my questions.</p>
  
  <p>In a spring web application, based on form login (user + pwd), I want to salt user passwords with SHA-256, using a random salt for each user. This means I have to save the salt and the hashed password in my database for each user. No issue so far.</p>
  
  <ol>
  <li><p>It seems clear that I have to implement my own <code>UserDetailsService</code> to fetch my user information's from my database and configure it in my <code>spring-security.xml</code>. </p></li>
  <li><p>It seems like I will have to add an extra <code>getSalt()</code> method on top of my implementation of <code>UserDetails</code> to make it available when checking the login provided by the user against the stored hashed password.</p></li>
  </ol>
  
  <p>Then the situation becomes unclear. I should intercept login requests. From section 6.4.3, it seems like Spring will map the user submitted credentials to an <code>Authentication</code> object and submit it to an <code>AuthenticationManager</code>.</p>
  
  <p>My questions are:</p>
  
  <p>i) What implementation of <code>Authentication</code> will Spring submit to the <code>AuthenticationManager</code>? How do I retrieve the name and password?</p>
  
  <p>ii) It seems like I would have to implement my own <code>AuthenticationManager</code>. At each call of <code>authenticate(...)</code>, I would fetch the login name and password, fetch <code>UserDetails</code> from the database. Then, hash the provided pwd with the corresponding salt and compare with the database hashed item. Correct?</p>
  
  <p>iii) The <code>AuthenticationManager</code> API also has a <code>supports(...)</code> method. How should it be implemented?</p>
  
  <p>iv) How should <code>Authentication</code> and <code>AuthenticationManager</code> be configured?</p>