title: Spring Security Password Authentication
body: <p>need some help or direction using Spring's security 3.1.x.</p>
  
  <p>I am storing an encrypted password in MySql database.  Which password is defined as a varchar(60) column.</p>
  
  <p>The first time running the web app, I generated the password with the following code snippet:</p>
  
  <pre><code>String p = "12345";
  PasswordEncoder passwordEncoder = new BCryptPasswordEncoder();
  String encodedPassword = passwordEncoder.encode(p);
  </code></pre>
  
  <p>I then took the String encodedPassword and pasted into the database column.  I kept the code in my authentication-manager (snippet follows), and logged encodedPassword to the server log.</p>
  
  <pre><code>&lt;security:authentication-manager alias="authenticationManager"&gt;
      &lt;security:authentication-provider user-service-ref="usersDAO"&gt; 
          &lt;security:password-encoder ref="encoder" /&gt;
      &lt;/security:authentication-provider&gt;
  &lt;/security:authentication-manager&gt;
  
  &lt;bean id="encoder" class="org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder" /&gt;
  </code></pre>
  
  <p>My problem is that authentication fails with exception: Bad credentials when BCryptPasswordEncoder.matches() runs.  The stored password is not matching the generated hash from the form input.  The same text password that was used in the initial hash generation was used. </p>
  
  <p>Each time I re-run the login entering the same text, the logged encodedPassword is different.  Debugging I can see where the entity is being returned from the database correctly, so I don't think that is an issue.  The issue seems to me that I'm not doing/setting something correctly in order to generate the same hash each time the text 
  password is entered.</p>
  
  <p>EDIT:
  Adding usersDAO.</p>
  
  <pre><code>import org.springframework.security.core.userdetails.UserDetailsService;
  
  public interface UsersDAO extends Dao&lt;Users&gt;, UserDetailsService 
  {
      Users getByUsername(String username);   
  }
  </code></pre>
  
  <p>EDIT:
  adding implementation.</p>
  
  <pre><code>import org.springframework.dao.DataAccessException;
  import org.springframework.security.core.userdetails.UserDetails;
  import org.springframework.security.core.userdetails.UsernameNotFoundException;
  import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
  import org.springframework.security.crypto.password.PasswordEncoder;
  import org.springframework.stereotype.Repository;
  import org.springframework.transaction.annotation.Transactional;
  
  import org.slf4j.Logger;
  import org.slf4j.LoggerFactory;
  
  
  @Repository("usersDAO")
  public class UsersDAO_DB extends AbstractHibernateDao&lt;Users&gt; implements UsersDAO
  {
  final Logger log = LoggerFactory.getLogger(this.getClass());
  
  @Override
  public Users getByUsername(String username) 
  {
      String p = "12345";
      PasswordEncoder passwordEncoder = new BCryptPasswordEncoder();
      String encodedPassword = passwordEncoder.encode(p);
      log.debug("HELLOZ  ----&gt;  " + encodedPassword);
  
      notNull(username, "username can't be null");
      return (Users) getSession()
          .getNamedQuery("users.byUsername")
          .setParameter("username", username)
          .uniqueResult();
  }
  
  @Override
  @Transactional
  public UserDetails loadUserByUsername(String username) throws     UsernameNotFoundException, DataAccessException {
      notNull(username, "username can't be null");
      Users users = getByUsername(username);
      if (users == null) {
          throw new UsernameNotFoundException("No user with username " +  username);
      }
      return users;
  }
  
  
  @Override
  public void create(Users t)
  {
      // TODO Auto-generated method stub
  }
  
  @Override
  public void update(Users t)
  {
      // TODO Auto-generated method stub
  
  }
  
  @Override
  public void delete(Users t)
  {
      // TODO Auto-generated method stub
  
  }
  </code></pre>
  
  <p>}</p>
  
  <p>Any ideas?</p>