Endless Authentication Loop with ActiveDirectoryLdapAuthenticationProvider on Incorrect Password

[juanmarques]

Describe the bug
Encountering an endless Authentication loop with Spring Security version 6.2.2 when incorrect LDAP credentials are provided. This occurs in a custom AuthenticationProvider that utilizes ActiveDirectoryLdapAuthenticationProvider. The error stems from recursive calls between an AuthenticationProvider and its parent, similar to issues discussed in related threads and #4203.

FINEST|13344/1|Service com.[redacted].console.[redacted]Console|24-04-11 14:44:04|11 Apr 2024 14:44:04,124 INFO [tomcat-handler-96] (ActiveDirectoryLdapAuthenticationProvider.java:236) - Active Directory authentication failed: Supplied password was invalid FINEST|13344/1|Service com.[redacted].console.[redacted]Console|24-04-11 14:44:04|11 Apr 2024 14:44:04,135 INFO [tomcat-handler-96] (ActiveDirectoryLdapAuthenticationProvider.java:236) - Active Directory authentication failed: Supplied password was invalid FINEST|13344/1|Service com.[redacted].console.[redacted]Console|24-04-11 14:44:04|11 Apr 2024 14:44:04,144 INFO [tomcat-handler-96] (ActiveDirectoryLdapAuthenticationProvider.java:236) - Active Directory authentication failed: Supplied password was invalid FINEST|13344/1|Service com.[redacted].console.[redacted]Console|24-04-11 14:44:04|11 Apr 2024 14:44:04,154 INFO [tomcat-handler-96] (ActiveDirectoryLdapAuthenticationProvider.java:236) - Active Directory authentication failed: Supplied password was invalid FINEST|13344/1|Service com.[redacted].console.[redacted]Console|24-04-11 14:44:04|11 Apr 2024 14:44:04,166 INFO [tomcat-handler-96] (ActiveDirectoryLdapAuthenticationProvider.java:236) - Active Directory authentication failed: Supplied password was invalid FINEST|13344/1|Service com.[redacted].console.[redacted]Console|24-04-11 14:44:04|11 Apr 2024 14:44:04,176 INFO [tomcat-handler-96] (ActiveDirectoryLdapAuthenticationProvider.java:236) - Active Directory authentication failed: Supplied password was invalid FINEST|13344/1|Service com.[redacted].console.[redacted]Console|24-04-11 14:44:04|11 Apr 2024 14:44:04,185 INFO [tomcat-handler-96] (ActiveDirectoryLdapAuthenticationProvider.java:236) - Active Directory authentication failed: Supplied password was invalid FINEST|13344/1|Service com.[redacted].console.[redacted]Console|24-04-11 14:44:04|11 Apr 2024 14:44:04,195 INFO [tomcat-handler-96] (ActiveDirectoryLdapAuthenticationProvider.java:236) - Active Directory authentication failed: Supplied password was invalid FINEST|13344/1|Service com.[redacted].console.[redacted]Console|24-04-11 14:44:04|11 Apr 2024 14:44:04,205 INFO [tomcat-handler-96] (ActiveDirectoryLdapAuthenticationProvider.java:236) - Active Directory authentication failed: Supplied password was invalid

To Reproduce

1. Configure ActiveDirectoryLdapAuthenticationProvider in a custom AuthenticationProvider.
2. Implement a condition within the custom provider that leads to delegation to a parent AuthenticationProvider.
3. Attempt LDAP authentication with an incorrect password.

Expected behavior
is expected to gracefully handle incorrect LDAP authentication attempts by throwing an AuthenticationException, not an Endless Authentication Loop , due to recursive provider delegation.