Users, Passwords and Authentication Providers

For username/password login, implement a UserDetailsService that loads users (with their authorities) from your database, and use a PasswordEncoder — PasswordEncoderFactories.createDelegatingPasswordEncoder() stores an {id} prefix (bcrypt by default) so you can upgrade algorithms later. Spring Security's DaoAuthenticationProvider ties them together, and UserDetailsPasswordService can rehash passwords on login.

@Service
class DbUserDetailsService implements UserDetailsService {
    private final UserRepository users;
    DbUserDetailsService(UserRepository users) { this.users = users; }

    @Override
    public UserDetails loadUserByUsername(String email) {
        var user = users.findByEmailIgnoreCase(email)
                .orElseThrow(() -> new UsernameNotFoundException("Bad credentials"));
        return User.withUsername(user.getEmail())
                .password(user.getPasswordHash())
                .roles(user.getRoles().toArray(String[]::new))
                .disabled(!user.isActive())
                .build();
    }
}

@Bean
PasswordEncoder passwordEncoder() {
    return PasswordEncoderFactories.createDelegatingPasswordEncoder();   // "{bcrypt}$2a$10$..."
}

Common pitfalls

• Storing plaintext or reversible passwords.
• NoOpPasswordEncoder outside of throwaway demos.
• Revealing whether an email exists through error messages.

Key points

• UserDetailsService loads users
• DelegatingPasswordEncoder for upgradeable hashing
• Generic 'bad credentials' errors

Further reading: Spring Security: Password storage