What roles do AuthenticationManager and AuthenticationProvider play in Spring Security's authentication flow?

Spring Security Internals & Testing

AuthenticationManager is the central entry point authentication filters delegate to — it receives an unauthenticated Authentication object (e.g., holding a submitted username/password) and returns a fully authenticated one (or throws AuthenticationException). Its default implementation, ProviderManager, doesn't do the actual verification itself — it delegates to a chain of AuthenticationProvider beans, trying each one until one supports the given Authentication type and successfully authenticates it (e.g., DaoAuthenticationProvider verifies username/password against a UserDetailsService and PasswordEncoder).