title: How to delegate an authentication-manager to a specific CustomUserDetailsService, based on the RequestHeaderAuthenticationFilter?
body: <p>I'm having a problem pre-authenticating users in a spring based app.</p>
  
  <p>Here is my scenario. I have two CustomUserDetailsServices, one for Employees and one for Customers. In front of my server it is implemented a proxy, that adds to the Http Header of the client request two header informations. Let's call theam <code>Header_A</code> and <code>Header_B</code>.</p>
  
  <p>I'd like that spring security to do the following steps:</p>
  
  <ol>
  <li>Take the <code>Header_A</code> and use it in the <code>EmployeeUserDetailsService</code>, to call the <code>loadUserByUsername(String name)</code> method. If the user is found, authenticate it and give him access to the app.</li>
  <li>If the user is not found(it is not identified as an employee), i'd like that security to take the <code>Header_B</code> and use it in the <code>CustomerUserDetailsService</code>.</li>
  </ol>
  
  <p>I've tried the following, and it works, but with a work-around(I don't want to do that work-around):</p>
  
  <pre class="lang-xml prettyprint-override"><code>&lt;sec:http use-expressions="true" access-denied-page="/denied.jsp" entry-point-ref="http403EntryPoint"&gt;
      &lt;sec:intercept-url pattern="/**" access="hasRole('ROLE_USER')" /&gt; 
      &lt;sec:custom-filter after="PRE_AUTH_FILTER" ref="customerFilter" /&gt;
      &lt;sec:custom-filter position="PRE_AUTH_FILTER" ref="employeeFilter" /&gt;
      &lt;sec:logout delete-cookies="true" invalidate-session="true" logout-success-url="/" /&gt;
  &lt;/sec:http&gt;
  &lt;bean id="employeeFilter" class="org.springframework.security.web.authentication.preauth.RequestHeaderAuthenticationFilter"&gt;
      &lt;property name="principalRequestHeader" value="Header_A"/&gt;
      &lt;property name="authenticationManager" ref="authenticationManager" /&gt;
      &lt;property name="exceptionIfHeaderMissing" value="false"/&gt;
  &lt;/bean&gt; 
  &lt;bean id="customerFilter" class="org.springframework.security.web.authentication.preauth.RequestHeaderAuthenticationFilter"&gt;
      &lt;property name="principalRequestHeader" value="Header_B"/&gt;
      &lt;property name="authenticationManager" ref="authenticationManager" /&gt;
      &lt;property name="exceptionIfHeaderMissing" value="false"/&gt;
  &lt;/bean&gt;
  &lt;bean id="employeePreAuthProvider" class="org.springframework.security.web.authentication.preauth.PreAuthenticatedAuthenticationProvider"&gt;
      &lt;property name="throwExceptionWhenTokenRejected" value="false" /&gt;
      &lt;property name="preAuthenticatedUserDetailsService"&gt;
          &lt;bean id="userDetailsServiceWrapper"  class="org.springframework.security.core.userdetails.UserDetailsByNameServiceWrapper"&gt;
              &lt;property name="userDetailsService" ref="employeeUserDetailsService"/&gt;
          &lt;/bean&gt;
      &lt;/property&gt;
  &lt;/bean&gt;
  &lt;bean id="customerPreAuthProvider" class="org.springframework.security.web.authentication.preauth.PreAuthenticatedAuthenticationProvider"&gt;
      &lt;property name="throwExceptionWhenTokenRejected" value="false" /&gt;
      &lt;property name="preAuthenticatedUserDetailsService"&gt;
          &lt;bean id="userDetailsServiceWrapper"  class="org.springframework.security.core.userdetails.UserDetailsByNameServiceWrapper"&gt;
              &lt;property name="userDetailsService" ref="customerUserDetailsService"/&gt;
          &lt;/bean&gt;
      &lt;/property&gt;
  &lt;/bean&gt;
  &lt;sec:authentication-manager alias="authenticationManager"&gt;
      &lt;sec:authentication-provider ref="employeePreAuthProvider" /&gt;
      &lt;sec:authentication-provider ref="customerPreAuthProvider" /&gt;
  &lt;/sec:authentication-manager&gt;    
  &lt;bean id="customerUserDetailsService" class="xxx.CustomerUserDetailsService"/&gt;
  &lt;bean id="employeeUserDetailsService" class="xxx.EmployeeUserDetailsService"/&gt;
  </code></pre>
  
  <p>This thing does the following:</p>
  
  <ol>
  <li>Takes Header_A and use it in EmployeeUserDetailsService</li>
  <li>Takes Header_B and use it in EmployeeUserDetailsService</li>
  <li>Takes Header_A and use it in CustomerUserDetailsServie</li>
  <li>Takes Header_B and use it in CustomerUserDetailsServie</li>
  </ol>
  
  <p>The workaround that I do is to verify the length of the headers(that is fix), and to return; if one header get's in the wrong UserDetailsService</p>