title: Spring Security - Differentiate between wrong username/password combination and unauthorised users
body: <p>In a Spring Boot + Spring Security application I have written my own <code>AuthenticationProvider</code>. It does authentication against another server, which holds information about usernames and their passwords. </p>
  
  <p>So far, everything works fine - through the use of <code>failureUrl(String)</code>on the <code>formLogin()</code>in the Security-Configuration I can tell people that they have used invalid username/password combinations. Spring will also automatically redirect unauthorised requests to the login-Form. </p>
  
  <p>However, there is the possibility that a user provides a valid username/password combination, but is simply not allowed to use the application anyway. Such user should, of course, not receive the same feedback of "wrong username/password", as that would be confusing to him. Is there any way in my <code>AuthenticationProvider</code>or maybe the Security-Configuration that I can somehow implement a case differentiation between these two? So far I can't see any way, returning null in the <code>AuthenticationProvider</code> makes Spring assume it's a "failure" and thus just redirects to the path specified in <code>failureUrl(String)</code>.</p>