title: Custom Authentication Provider Not Being Called
body: <p>I'm trying to setup a customer AuthenticationProvider with Spring Security but not having much luck getting it working.  I'm using <strong>Java configuration</strong> so I'm probably missing something simple but as most the learning material is XML config based, it's not jumping out at me.</p>
  
  <p>This is using Spring v4.0.1.RELEASE but with Spring Security v3.2.2.RELEASE.  Version number clash perhaps?</p>
  
  <p>As far as I could tell, all I had to do was create my provider:</p>
  
  <pre><code>public class KBServicesAuthProvider implements AuthenticationProvider {
    @Autowired
    private ApplicationConfig applicationConfig;
  
    @Autowired
    private SessionServiceClient sessionServiceClient;
  
    @Override
    public Authentication authenticate(Authentication authentication) throws AuthenticationException {
      String email = (String) authentication.getPrincipal();
      String password = (String) authentication.getCredentials();
  
      try {
        KBSessionInfo sessionInfo = sessionServiceClient.login(applicationConfig.getKbServicesPresenceId(), email,
            password);
  
        List&lt;GrantedAuthority&gt; grantedRoles = new ArrayList&lt;&gt;();
        for (KBRoleMembership role : sessionInfo.getAuthenticatedUser().getRoleMemberships()) {
          grantedRoles.add(new SimpleGrantedAuthority(role.getRoleId()));
        }
  
        return new UsernamePasswordAuthenticationToken(email, password, grantedRoles);
      } catch (InvalidSessionException e) {
        throw new AuthenticationCredentialsNotFoundException("Username or password was not accepted", e);
      }
    }
  
    @Override
    public boolean supports(Class&lt;?&gt; authentication) {
      return authentication.equals(UsernamePasswordAuthenticationToken.class);
    }
  }
  </code></pre>
  
  <p>And then setup a class to describe my security setup. This class links in my provider:</p>
  
  <pre><code>@Configuration
  @EnableWebMvcSecurity
  public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
  
    @Autowired(required = true)
    SessionServiceClient sessionServiceClient;
  
    @Override
    protected void configure(HttpSecurity http) throws Exception {
      http.authorizeRequests().antMatchers("/").permitAll().anyRequest().authenticated();
      http.formLogin().loginPage("/login").permitAll().and().logout().permitAll();
    }
  
    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
      auth.authenticationProvider(getKBServicesAuthenticationProvider());
    }
  
    @Bean
    protected AuthenticationProvider getKBServicesAuthenticationProvider() {
      return new KBServicesAuthProvider();
    }
  }
  </code></pre>
  
  <p>But I'm not seeing anything in the logs &amp; none of my debug points are being hit.  The app acts as it's unsecured (so I can reach various URLs etc. still).</p>
  
  <p>Any ideas on what I should be checking?</p>