Currently, if the Authentication.getDetails()
is non-null on the input to ProviderManager
, then the ProviderManager.copyDetails
method will invoke Authentication.toBuilder()
method to set the details. This is fine if an Authentication
implements toBuilder
, but it unnecessarily breaks custom Authentication
types that do not implement toBuilder
.
We should revert the behavior to previous versions of Spring Security which invoke AbstractAuthenticationToken.setDetails
.
Possibly related to gh-18021
Related 35f41f8