Why isn't there a simple way to set `org.springframework.security.authentication.dao.AbstractUserDetailsAuthenticationProvider#hideUserNotFoundExceptions` to `false`?

[yvasyliev]

Expected Behavior

I would like to have I convenient way to set org.springframework.security.authentication.dao.AbstractUserDetailsAuthenticationProvider#hideUserNotFoundExceptions to false. An application property or bean customizer would be great.

Current Behavior

@Configuration
@Import(AuthenticationConfiguration.class)
@EnableMethodSecurity
public class SecurityConfig {
    @Bean
    public AuthenticationManager authenticationManager(AuthenticationConfiguration authConfig) throws Exception {
        var authenticationManager = (ProviderManager) authConfig.getAuthenticationManager();
        var provider = (AbstractUserDetailsAuthenticationProvider) authenticationManager.getProviders().getFirst();
        provider.setHideUserNotFoundExceptions(false); // <-- it's quite a long way to set this property
        return authenticationManager;
    }

    @Bean
    public UserDetailsService userDetailsService() {
        return new InMemoryUserDetailsManager(new User(
                "adminId",
                "{noop}",
                AuthorityUtils.createAuthorityList("ROLE_ADMIN")
        ));
    }
}

Context

I'm building a non-web application. I use Spring Security to protect my methods outside the web servlet context. I need to catch UsernameNotFoundException intead of BadCredentialsException.

DaoAuthenticationProvider is created in this place:

spring-security/config/src/main/java/org/springframework/security/config/annotation/authentication/configuration/InitializeUserDetailsBeanManagerConfigurer.java

Lines 67 to 112 in eaab42a

	@Override
	public void configure(AuthenticationManagerBuilder auth) throws Exception {
	String[] beanNames = InitializeUserDetailsBeanManagerConfigurer.this.context
	.getBeanNamesForType(UserDetailsService.class);
	if (auth.isConfigured()) {
	if (beanNames.length > 0) {
	this.logger.warn("Global AuthenticationManager configured with an AuthenticationProvider bean. "
	+ "UserDetailsService beans will not be used by Spring Security for automatically configuring username/password login. "
	+ "Consider removing the AuthenticationProvider bean. "
	+ "Alternatively, consider using the UserDetailsService in a manually instantiated DaoAuthenticationProvider. "
	+ "If the current configuration is intentional, to turn off this warning, "
	+ "increase the logging level of 'org.springframework.security.config.annotation.authentication.configuration.InitializeUserDetailsBeanManagerConfigurer' to ERROR");
	}
	return;
	}
	if (beanNames.length == 0) {
	return;
	}
	else if (beanNames.length > 1) {
	this.logger.warn(LogMessage.format("Found %s UserDetailsService beans, with names %s. "
	+ "Global Authentication Manager will not use a UserDetailsService for username/password login. "
	+ "Consider publishing a single UserDetailsService bean.", beanNames.length,
	Arrays.toString(beanNames)));
	return;
	}
	UserDetailsService userDetailsService = InitializeUserDetailsBeanManagerConfigurer.this.context
	.getBean(beanNames[0], UserDetailsService.class);
	PasswordEncoder passwordEncoder = getBeanOrNull(PasswordEncoder.class);
	UserDetailsPasswordService passwordManager = getBeanOrNull(UserDetailsPasswordService.class);
	CompromisedPasswordChecker passwordChecker = getBeanOrNull(CompromisedPasswordChecker.class);
	DaoAuthenticationProvider provider = new DaoAuthenticationProvider(userDetailsService);
	if (passwordEncoder != null) {
	provider.setPasswordEncoder(passwordEncoder);
	}
	if (passwordManager != null) {
	provider.setUserDetailsPasswordService(passwordManager);
	}
	if (passwordChecker != null) {
	provider.setCompromisedPasswordChecker(passwordChecker);
	}
	provider.afterPropertiesSet();
	auth.authenticationProvider(provider);
	this.logger.info(LogMessage.format(
	"Global AuthenticationManager configured with UserDetailsService bean with name %s", beanNames[0]));
	}

DaoAuthenticationProvider appears to be a local variable with explicit constructor call. So there's no chance to call DaoAuthenticationProvider.setHideUserNotFoundExceptions at this stage.

[kse-music]

Is it possible to work around?

try {
          ...
        } catch (BadCredentialsException e){
            Throwable cause = e.getCause();
            if (cause instanceof UsernameNotFoundException){
                
           }
     }

[yvasyliev]

@kse-music I'm using Spring Security v6.5.0, and it's not an option there because org.springframework.security.authentication.dao.AbstractUserDetailsAuthenticationProvider#authenticate replaces UsernameNotFoundException with BadCredentialsException, not wraps...

spring-security/core/src/main/java/org/springframework/security/authentication/dao/AbstractUserDetailsAuthenticationProvider.java

Lines 135 to 145 in 0fd0e93

	try {
	user = retrieveUser(username, (UsernamePasswordAuthenticationToken) authentication);
	}
	catch (UsernameNotFoundException ex) {
	this.logger.debug(LogMessage.format("Failed to find user '%s'", username));
	if (!this.hideUserNotFoundExceptions) {
	throw ex;
	}
	throw new BadCredentialsException(this.messages
	.getMessage("AbstractUserDetailsAuthenticationProvider.badCredentials", "Bad credentials"));
	}

But I just found that the code in the main branch is different and your approach should work:

spring-security/core/src/main/java/org/springframework/security/authentication/dao/AbstractUserDetailsAuthenticationProvider.java

Lines 135 to 146 in 2e913d2

	try {
	user = retrieveUser(username, (UsernamePasswordAuthenticationToken) authentication);
	}
	catch (UsernameNotFoundException ex) {
	this.logger.debug(LogMessage.format("Failed to find user '%s'", username));
	String message = this.messages.getMessage("AbstractUserDetailsAuthenticationProvider.badCredentials",
	"Bad credentials");
	if (!this.hideUserNotFoundExceptions) {
	throw ex;
	}
	throw new BadCredentialsException(message, ex);
	}

The commit was 3 days ago, so it should be fine in the future updates 😄