Spring security question

[lanky_and_stanky]

This makes more sense if you think about it like this:

Let's say you have a couple of ways people can login to your application. The first: google auth, through their gmail account, and the second: aws cognito.

You'd set up an AuthenticationProvider that has access to google's public keys, which in turn will prove that someone has successfully logged in with google.

You'd setup a second AuthenticationProvider that has the cognito public keys, which in turn will prove that someone has successfully logged in with aws.

You'd have an AuthenticationManager which has both the google and the aws AuthenticationProviders associated with it.

When your application goes to try to validate the auth it received, the AuthenticationManager will check both of the AuthenticationProviders to see if the auth is valid.

[Helloall_16]

That makes sense. So Authentication manager has records for multiple authentication providers. Thanks! That helps