JHipster集成JWT时，用户密码校验逻辑位置咨询

Hey there! I totally get why this feels confusing—JHipster's Spring Security setup can seem like a maze when you're trying to trace login flows. Let's break down exactly where that user/password check happens, since you're not seeing the components you expected being called.

First, a critical note: api/authenticate isn't handled by a regular Controller #

You mentioned UserJWTController wasn't invoked, and that's totally normal for most recent JHipster versions. The /api/authenticate endpoint is intercepted directly by a custom Spring Security filter, not a standard @RestController. That's why you don't see that controller firing.

The validation flow starts in JWTAuthenticationFilter #

When your client sends a POST to /api/authenticate, this filter is the first to catch the request. Here's the play-by-play inside its attemptAuthentication method:

• It parses the JSON request body to pull out the username and password you submitted.
• It creates a UsernamePasswordAuthenticationToken with these credentials.
• The magic happens when it calls getAuthenticationManager().authenticate(token)—this triggers the actual user/password validation.

The real validation work is done by AuthenticationManager and its providers #

The AuthenticationManager passes the token to DaoAuthenticationProvider, which handles two key checks:

1. It calls your DomainUserDetailsService.loadUserByUsername(username) to fetch the user's stored details (including their encrypted password) from the database. If the username doesn't exist, this method throws a UsernameNotFoundException.
2. It uses your configured PasswordEncoder to compare the raw password from your request with the encrypted password stored in the database. If they don't match, it throws a BadCredentialsException.

Why you might not see DomainUserDetailsService being called #

If you entered a username that doesn't exist in your database, loadUserByUsername will throw an exception immediately—this gets wrapped into a BadCredentialsException before your breakpoint might trigger. Try testing with a valid username but wrong password, and you should see DomainUserDetailsService get invoked then.

Quick debugging tips to confirm this flow #

• Drop a breakpoint inside JWTAuthenticationFilter.attemptAuthentication—every login request will hit this method first.
• Check your SecurityConfiguration class to make sure JWTAuthenticationFilter is properly registered in the filter chain and mapped to /api/authenticate.
• Double-check that your DomainUserDetailsService is annotated with @Service (or another Spring bean annotation) so the DaoAuthenticationProvider can find and use it.

内容的提问来源于stack exchange，提问作者johnb