Backend interview prep

Start

Spring Security Authentication Interview Questions and Answers

Master Spring Security Authentication with interview questions covering AuthenticationManager, AuthenticationProvider, UserDetailsService, UserDetails, PasswordEncoder, SecurityContext, login flow, authentication lifecycle, and production best practices.

Introduction

Authentication is the first step in securing any enterprise application.

Before a user can access protected resources, the application must verify their identity.

Examples

  • Banking Login
  • ATM Authentication
  • Healthcare Portal Login
  • Employee Portal
  • Insurance Portal
  • E-Commerce Login

Spring Security provides a powerful authentication framework that supports

  • Username & Password
  • JWT
  • OAuth2
  • LDAP
  • Single Sign-On (SSO)
  • Multi-Factor Authentication (MFA)

The authentication process is coordinated by several core Spring Security components.

Authentication Architecture

flowchart LR

Client --> SecurityFilterChain

SecurityFilterChain --> AuthenticationManager

AuthenticationManager --> AuthenticationProvider

AuthenticationProvider --> UserDetailsService

UserDetailsService --> Database

AuthenticationProvider --> PasswordEncoder

PasswordEncoder --> SecurityContext

SecurityContext --> Controller

Q1. What is Authentication?

Answer

Authentication is the process of verifying the identity of a user or system.

It answers the question:

Who are you?

Common authentication methods

  • Username & Password
  • OTP
  • Biometric Authentication
  • JWT
  • OAuth2 Login
  • Smart Cards

Authentication occurs before authorization.

Q2. What is AuthenticationManager?

AuthenticationManager is the central interface responsible for authentication.

Responsibilities

  • Receive authentication request.
  • Delegate authentication.
  • Return authenticated user.
  • Throw exception if authentication fails.

Example

Authentication authenticate(
    Authentication authentication
);

It coordinates the complete authentication process.

Q3. What is AuthenticationProvider?

AuthenticationProvider performs the actual authentication.

Responsibilities

  • Validate username.
  • Verify password.
  • Load user information.
  • Return authenticated object.

Authentication Flow

flowchart LR

AuthenticationManager --> AuthenticationProvider

AuthenticationProvider --> UserDetailsService

AuthenticationProvider --> PasswordEncoder

Different providers support different authentication mechanisms.

Q4. What is UserDetailsService?

UserDetailsService loads user information.

Method

UserDetails
loadUserByUsername(
    String username
);

Responsibilities

  • Find user
  • Load password
  • Load roles
  • Return UserDetails

Usually implemented using a database.

Q5. What is UserDetails?

UserDetails represents the authenticated user.

It contains

  • Username
  • Password
  • Roles
  • Authorities
  • Account Status

Example

UserDetails

Spring Security uses this object throughout authentication.

Q6. What is PasswordEncoder?

Passwords must never be stored in plain text.

Spring Security provides

  • BCrypt
  • Argon2
  • PBKDF2
  • SCrypt

Example

new BCryptPasswordEncoder()

BCrypt automatically generates a random salt for every password.

Q7. What happens after successful authentication?

After successful login

  1. Authentication object created.
  2. Stored in SecurityContext.
  3. Request continues.
  4. Authorization begins.

Successful Login

flowchart TD

AuthenticationSuccess --> SecurityContext

SecurityContext --> Authorization

Authorization --> Controller

Q8. What happens if authentication fails?

Examples

  • Wrong password
  • User not found
  • Account locked
  • Account expired
  • Credentials expired

Spring throws

AuthenticationException

Common subclasses

  • BadCredentialsException
  • LockedException
  • DisabledException

Q9. How does the complete authentication flow work?

Workflow

  1. User submits credentials.
  2. SecurityFilterChain intercepts request.
  3. AuthenticationManager invoked.
  4. AuthenticationProvider authenticates.
  5. UserDetailsService loads user.
  6. PasswordEncoder validates password.
  7. SecurityContext stores authentication.
  8. Controller executes.

Complete Authentication Flow

sequenceDiagram
Client->>SecurityFilterChain: Login Request
SecurityFilterChain->>AuthenticationManager: Authenticate
AuthenticationManager->>AuthenticationProvider: Authenticate
AuthenticationProvider->>UserDetailsService: Load User
UserDetailsService-->>AuthenticationProvider: UserDetails
AuthenticationProvider->>PasswordEncoder: Verify Password
PasswordEncoder-->>AuthenticationProvider: Success
AuthenticationProvider-->>AuthenticationManager: Authentication
AuthenticationManager-->>SecurityContext: Store
SecurityContext-->>Controller: Continue

Q10. Authentication Best Practices

Use Strong Password Hashing

Prefer BCrypt or Argon2.

Enable Multi-Factor Authentication

Protect sensitive accounts.

Lock Accounts After Failed Attempts

Reduce brute-force attacks.

Never Expose Passwords

Return DTOs only.

Audit Login Attempts

Monitor suspicious activity.

Banking Example

flowchart TD

Customer --> Login

Login --> AuthenticationManager

AuthenticationManager --> UserDetailsService

UserDetailsService --> PostgreSQL

AuthenticationManager --> BCrypt

BCrypt --> SecurityContext

SecurityContext --> BankingDashboard

Only authenticated users reach protected banking resources.

Common Interview Questions

  • What is Authentication?
  • What is AuthenticationManager?
  • What is AuthenticationProvider?
  • What is UserDetailsService?
  • What is UserDetails?
  • What is PasswordEncoder?
  • What happens after successful authentication?
  • What happens when authentication fails?
  • Explain the complete authentication flow.
  • Authentication best practices?

Quick Revision

Topic Summary
Authentication Verify identity
AuthenticationManager Coordinates authentication
AuthenticationProvider Performs authentication
UserDetailsService Loads users
UserDetails Authenticated user
PasswordEncoder Verifies passwords
SecurityContext Stores authentication
Authentication Login result
AuthenticationException Login failure
BCrypt Recommended password hashing

Internal Authentication Lifecycle

sequenceDiagram
Browser->>UsernamePasswordAuthenticationFilter: Username & Password
UsernamePasswordAuthenticationFilter->>AuthenticationManager: Authenticate
AuthenticationManager->>DaoAuthenticationProvider: Delegate
DaoAuthenticationProvider->>UserDetailsService: Load User
UserDetailsService-->>DaoAuthenticationProvider: UserDetails
DaoAuthenticationProvider->>BCryptPasswordEncoder: Match Password
BCryptPasswordEncoder-->>DaoAuthenticationProvider: Valid
DaoAuthenticationProvider-->>AuthenticationManager: Authenticated
AuthenticationManager->>SecurityContextHolder: Store Authentication
SecurityContextHolder-->>Controller: Continue Request

Production Example – Banking Login Authentication

A customer logs into a mobile banking application.

Workflow

  1. Customer enters username and password.

  2. Request reaches the SecurityFilterChain.

  3. UsernamePasswordAuthenticationFilter extracts credentials.

  4. AuthenticationManager delegates to DaoAuthenticationProvider.

  5. UserDetailsService loads customer information from PostgreSQL.

  6. BCryptPasswordEncoder compares the submitted password with the stored hash.

  7. If valid:

    • An authenticated UsernamePasswordAuthenticationToken is created.
    • It is stored in the SecurityContextHolder.

  8. Authorization begins.

  9. Customer accesses protected APIs.

@Bean
PasswordEncoder passwordEncoder() {
    return new BCryptPasswordEncoder();
}

flowchart LR

MobileApp --> UsernamePasswordAuthenticationFilter

UsernamePasswordAuthenticationFilter --> AuthenticationManager

AuthenticationManager --> DaoAuthenticationProvider

DaoAuthenticationProvider --> UserDetailsService

UserDetailsService --> PostgreSQL

DaoAuthenticationProvider --> BCryptPasswordEncoder

BCryptPasswordEncoder --> SecurityContextHolder

SecurityContextHolder --> AccountController

AuthenticationManager vs AuthenticationProvider

Feature AuthenticationManager AuthenticationProvider
Responsibility Coordinates authentication Performs authentication
Interface AuthenticationManager AuthenticationProvider
Authentication Logic Delegates Implements
Multiple Providers ✅ ❌
Typical Implementation ProviderManager DaoAuthenticationProvider

UserDetails vs Authentication

UserDetails Authentication
User information Authentication result
Username, Password, Roles Principal, Credentials, Authorities
Loaded from database Created after successful login
Returned by UserDetailsService Stored in SecurityContextHolder

Key Takeaways

  • Authentication verifies a user's identity before allowing access to protected resources.
  • AuthenticationManager coordinates the authentication process by delegating to one or more AuthenticationProviders.
  • AuthenticationProvider performs credential verification using UserDetailsService and PasswordEncoder.
  • UserDetailsService loads user information from a data source, while UserDetails represents the authenticated user.
  • BCryptPasswordEncoder is the most commonly used password hashing implementation because it automatically generates unique salts and is resistant to brute-force attacks.
  • After successful authentication, Spring stores the authenticated Authentication object inside the SecurityContextHolder.
  • Failed authentication attempts result in AuthenticationException subclasses such as BadCredentialsException or LockedException.
  • Strong password hashing, MFA, account lockout policies, and authentication auditing are essential for building secure enterprise applications.