title: Authentication issue in Spring Security (checking only username not password?)
body: <p>this is my first project with Spring and I have just started to create the login with Spring Security. I want some pages to be accessible only for the admin and not for the players. I've found some examples on the web and this mechanism works pretty well, I have this secured page that is protected by the login and it's forbidden when the user has no ROLE_ADMIN.</p>
  
  <pre><code>@PreAuthorize("hasAuthority('ROLE_ADMIN')")
      @GetMapping("/secured/all")
      public String securedHello() {
          return "Secured Hello";
      } 
  </code></pre>
  
  <p>The problem is that testing my code I found out that Spring authenticates the admin (and the user as well) only checking the username. If I put the wrong password it allows me to enter anyway. I don't understand how this is possible, shouldn't Spring Security do all the authentication work by itself? I've seen somebody suggested to implement an authentication manager or something like that, but I don't understand why and how to insert it in my code. I'm stuck on this since two days, please any advice wuold be really appreciated.
  These are my classes:</p>
  
  <pre><code>package model;
  import java.io.IOException;
  import javax.naming.AuthenticationException;
  import javax.servlet.http.HttpServletRequest;
  import javax.servlet.http.HttpServletResponse;
  import org.springframework.beans.factory.annotation.Autowired;
  import org.springframework.context.annotation.ComponentScan;
  import org.springframework.context.annotation.Configuration;
  import org.springframework.data.jpa.repository.config.EnableJpaRepositories;
  import org.springframework.http.HttpStatus;
  import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
  import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
  import org.springframework.security.config.annotation.web.builders.HttpSecurity;
  import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
  import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
  import org.springframework.security.core.Authentication;
  import org.springframework.security.crypto.password.PasswordEncoder;
  
  import com.fasterxml.jackson.databind.ObjectMapper;
  
  @EnableGlobalMethodSecurity(prePostEnabled = true)
  @EnableWebSecurity
  @EnableJpaRepositories(basePackageClasses = PlayersRepository.class)
  @ComponentScan(basePackageClasses= CustomUserDetailsService.class)
  @Configuration
  public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
  
  
      @Autowired
      private CustomUserDetailsService userDetailsService;
  
      @Override
      protected void configure(AuthenticationManagerBuilder auth) throws Exception {
  
          auth.userDetailsService(userDetailsService)
          .passwordEncoder(getPasswordEncoder());
      }
  
  
      @Override
      protected void configure(HttpSecurity http) throws Exception {
  
          //http.csrf().disable();
          http.authorizeRequests()
                  .antMatchers("**/secured/**").access("hasAuthority('ROLE_ADMIN')")
                  .anyRequest().permitAll()
                  .and()
                      .formLogin().permitAll();
  
      }
  
      private PasswordEncoder getPasswordEncoder() {
          return new PasswordEncoder() {
              @Override
              public String encode(CharSequence charSequence) {
                  return charSequence.toString();
              }
  
              @Override
              public boolean matches(CharSequence charSequence, String s) {
                  return true;
              }
          };
      }
  }
  
  
  package model;
  
  import java.util.ArrayList;
  import java.util.Optional;
  
  import org.springframework.beans.factory.annotation.Autowired;
  import org.springframework.security.core.userdetails.User;
  import org.springframework.security.core.userdetails.UserDetails;
  import org.springframework.security.core.userdetails.UserDetailsService;
  import org.springframework.security.core.userdetails.UsernameNotFoundException;
  import org.springframework.stereotype.Service;
  
  @Service
  public class CustomUserDetailsService implements UserDetailsService {
  
  
      @Autowired
      private PlayersRepository usersRepository;
      @Autowired
      private RoleRepository rolesRepository;
  
      public CustomUserDetailsService(PlayersRepository usersRepository, RoleRepository rolesRepository) {
          this.usersRepository=usersRepository;
          this.rolesRepository=rolesRepository;
      }
   @Override
      public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
          Optional&lt;Player&gt; optionalUser = usersRepository.findByUsername(username);
  
          optionalUser
                  .orElseThrow(() -&gt; new UsernameNotFoundException("Username not found"));
          Player user= optionalUser.get();
          System.out.println(user);
          return  toUserDetails(new UserObject(user.getUsername(),user.getPassword(),user.getRole()));
      }
  
  
  
      private UserDetails toUserDetails(UserObject userObject) {
          return User.withUsername(userObject.name)
                     .password(userObject.password)
                     .roles(userObject.role).build();
      }
  
      private static class UserObject {
          private String name;
          private String password;
          private String role;
  
          public UserObject(String name, String password, String role) {
              this.name = name;
              this.password = password;
              this.role = role;
          }
      }
  
  }
  
  
  
  package model;
  
  import org.springframework.security.core.GrantedAuthority;
  import org.springframework.security.core.authority.SimpleGrantedAuthority;
  import org.springframework.security.core.userdetails.UserDetails;
  
  import java.util.ArrayList;
  import java.util.Collection;
  import java.util.List;
  import java.util.Optional;
  import java.util.stream.Collectors;
  
  public class CustomUserDetails extends Player implements UserDetails {
  
  
      String role;
  
      public CustomUserDetails(final Player user) {
          super(user);
      }
  
      public CustomUserDetails(Optional&lt;Player&gt; user, String role) {
          super(user);
          this.role=role;
      }
  
      @Override
      public Collection&lt;? extends GrantedAuthority&gt; getAuthorities() {
  
          List&lt;GrantedAuthority&gt; list = new ArrayList&lt;GrantedAuthority&gt;();
  
          list.add(new SimpleGrantedAuthority("ROLE_"+ role));
  
          System.out.println(list); 
          return list;
      }
  
      @Override
      public String getPassword() {
          return super.getPassword();
      }
  
      @Override
      public String getUsername() {
          return super.getUsername();
      }
  
      @Override
      public boolean isAccountNonExpired() {
          return true;
      }
  
      @Override
      public boolean isAccountNonLocked() {
          return true;
      }
  
      @Override
      public boolean isCredentialsNonExpired() {
          return true;
      }
  
      @Override
      public boolean isEnabled() {
          return true;
      }
  
  
  }
  </code></pre>