java - Spring Security, Boot: replace default DaoAuthenticationProvider -

i trying add user ip verification during login process. if ip address of user not in database application should reject authentication.

the problem: given setup below turns out auth.authenticationprovider() not replacing default daoauthenticationprovider, adds useripauthenticationprovider first authenticationprovider in list.

in case when username/password combination incorrect framework ends calling userdetailsservice.loaduserbyusername() twice, once useripauthenticationprovider, time internal daoauthenticationprovider throws final badcredentialsexception().

the question: there setting can set in spring boot spring security not add it's own internal instance daoauthenticationprovider, use useripauthenticationprovider, has necessary functionality (perhaps somehow replacing authenticationmanagerbuilder able override userdetailsservice() method?).

public <t extends userdetailsservice> daoauthenticationconfigurer<authenticationmanagerbuilder,t> userdetailsservice(         t userdetailsservice) throws exception {     this.defaultuserdetailsservice = userdetailsservice;     return apply(new daoauthenticationconfigurer<authenticationmanagerbuilder,t>(userdetailsservice)); } 

configuration: in understanding, userdetailsservice supposed provide necessary details user authenticationprovider can make decision whether authentication successful or not.

since necessary information loaded database, seems natural extend daoauthenticationprovider , add additional verification in overriden additionalauthenticationchecks() method (white-listed ip list in database, loaded part of user object in ipawareuser).

@named @component class useripauthenticationprovider  extends daoauthenticationprovider {     @inject     public useripauthenticationprovider(userdetailsservice userdetailsservice)     {         ...     }      @suppresswarnings("deprecation")     protected void additionalauthenticationchecks(userdetails userdetails,                                                   usernamepasswordauthenticationtoken authentication) throws authenticationexception {         super.additionalauthenticationchecks(userdetails, authentication);          webauthenticationdetails details = (webauthenticationdetails) authentication.getdetails();         ipawareuser ipawareuser = (ipawareuser) userdetails;         if (!ipawareuser.isallowedip(details.getremoteaddress()))         {             throw new disabledexception("login restricted ip: " + details.getremoteaddress());         }     } } 

this injected securityconfiguration:

@configuration @enableglobalmethodsecurity(prepostenabled = true) @enablewebsecurity public class securityconfiguration extends websecurityconfigureradapter {      @override     protected void configure(httpsecurity http) throws exception {         http.addfilter(authenticationfilter);          http.authorizerequests()                 .antmatchers("/", "/javascript/**", "/css/**").permitall()                 .antmatchers("...").access("...")                 .anyrequest().authenticated()                 .and().formlogin().loginpage("/").permitall()                 .and().logout().invalidatehttpsession(true).deletecookies("jsessionid").permitall()                 .and().csrf().disable()         ;     }      @inject     private userdetailsservice userdetailsservice;      @inject     private useripauthenticationprovider useripauthenticationprovider;       @inject     private jsonusernamepasswordauthenticationfilter authenticationfilter;      @bean     public jsonusernamepasswordauthenticationfilter authenticationfilter() {         return new jsonusernamepasswordauthenticationfilter();     }      @override     protected void configure(authenticationmanagerbuilder auth) throws exception {         auth.authenticationprovider(useripauthenticationprovider);         auth.userdetailsservice(userdetailsservice);     }      @bean     @override     public authenticationmanager authenticationmanagerbean() throws exception {         return super.authenticationmanagerbean();     }      @bean     public authenticationsuccesshandler authenticationsuccesshandler() throws exception {         return new jsonauthenticationsuccesshandler();     }      @bean     public authenticationfailurehandler authenticationfailurehandler() throws exception {         return new jsonauthenticationfailurehandler();     } } 

and application configuration:

@configuration @enableautoconfiguration @componentscan(basepackageclasses = {securityconfiguration.class, datacontroller.class, daoservice.class}) public class application extends springbootservletinitializer {      @override     protected springapplicationbuilder configure(springapplicationbuilder application) {         return application;     } } 

any guidance on appreciated.