config/src/main/java/org/springframework/security/config/http/HttpSecurityBeanDefinitionParser.java
private BeanReference createAuthenticationManager(Element element, ParserContext pc,
			ManagedList<BeanReference> authenticationProviders) {
		String parentMgrRef = element.getAttribute(ATT_AUTHENTICATION_MANAGER_REF);
		BeanDefinitionBuilder authManager = BeanDefinitionBuilder
				.rootBeanDefinition(ProviderManager.class);
		authManager.addConstructorArgValue(authenticationProviders);

		if (StringUtils.hasText(parentMgrRef)) {
			RuntimeBeanReference parentAuthManager = new RuntimeBeanReference(
					parentMgrRef);
			authManager.addConstructorArgValue(parentAuthManager);
			RootBeanDefinition clearCredentials = new RootBeanDefinition(
					ClearCredentialsMethodInvokingFactoryBean.class);
			clearCredentials.getPropertyValues().addPropertyValue("targetObject",
					parentAuthManager);
			clearCredentials.getPropertyValues().addPropertyValue("targetMethod",
					"isEraseCredentialsAfterAuthentication");

			authManager.addPropertyValue("eraseCredentialsAfterAuthentication",
					clearCredentials);
		}
		else {
			RootBeanDefinition amfb = new RootBeanDefinition(
					AuthenticationManagerFactoryBean.class);
			amfb.setRole(BeanDefinition.ROLE_INFRASTRUCTURE);
			String amfbId = pc.getReaderContext().generateBeanName(amfb);
			pc.registerBeanComponent(new BeanComponentDefinition(amfb, amfbId));
			RootBeanDefinition clearCredentials = new RootBeanDefinition(
					MethodInvokingFactoryBean.class);
			clearCredentials.getPropertyValues().addPropertyValue("targetObject",
					new RuntimeBeanReference(amfbId));
			clearCredentials.getPropertyValues().addPropertyValue("targetMethod",
					"isEraseCredentialsAfterAuthentication");

			authManager.addConstructorArgValue(new RuntimeBeanReference(amfbId));
			authManager.addPropertyValue("eraseCredentialsAfterAuthentication",
					clearCredentials);
		}

		authManager.getRawBeanDefinition().setSource(pc.extractSource(element));
		BeanDefinition authMgrBean = authManager.getBeanDefinition();
		String id = pc.getReaderContext().generateBeanName(authMgrBean);
		pc.registerBeanComponent(new BeanComponentDefinition(authMgrBean, id));

		return new RuntimeBeanReference(id);
	}
private BeanReference createAuthenticationManager(Element element, ParserContext pc,
			ManagedList<BeanReference> authenticationProviders) {
		String parentMgrRef = element.getAttribute(ATT_AUTHENTICATION_MANAGER_REF);
		BeanDefinitionBuilder authManager = BeanDefinitionBuilder
				.rootBeanDefinition(ProviderManager.class);
		authManager.addConstructorArgValue(authenticationProviders);

		if (StringUtils.hasText(parentMgrRef)) {
			RuntimeBeanReference parentAuthManager = new RuntimeBeanReference(
					parentMgrRef);
			authManager.addConstructorArgValue(parentAuthManager);
			RootBeanDefinition clearCredentials = new RootBeanDefinition(
					ClearCredentialsMethodInvokingFactoryBean.class);
			clearCredentials.getPropertyValues().addPropertyValue("targetObject",
					parentAuthManager);
			clearCredentials.getPropertyValues().addPropertyValue("targetMethod",
					"isEraseCredentialsAfterAuthentication");

			authManager.addPropertyValue("eraseCredentialsAfterAuthentication",
					clearCredentials);
		}
		else {
			RootBeanDefinition amfb = new RootBeanDefinition(
					AuthenticationManagerFactoryBean.class);
			amfb.setRole(BeanDefinition.ROLE_INFRASTRUCTURE);
			String amfbId = pc.getReaderContext().generateBeanName(amfb);
			pc.registerBeanComponent(new BeanComponentDefinition(amfb, amfbId));
			RootBeanDefinition clearCredentials = new RootBeanDefinition(
					MethodInvokingFactoryBean.class);
			clearCredentials.getPropertyValues().addPropertyValue("targetObject",
					new RuntimeBeanReference(amfbId));
			clearCredentials.getPropertyValues().addPropertyValue("targetMethod",
					"isEraseCredentialsAfterAuthentication");

			authManager.addConstructorArgValue(new RuntimeBeanReference(amfbId));
			authManager.addPropertyValue("eraseCredentialsAfterAuthentication",
					clearCredentials);
		}

		authManager.getRawBeanDefinition().setSource(pc.extractSource(element));
		BeanDefinition authMgrBean = authManager.getBeanDefinition();
		String id = pc.getReaderContext().generateBeanName(authMgrBean);
		pc.registerBeanComponent(new BeanComponentDefinition(authMgrBean, id));

		return new RuntimeBeanReference(id);
	}
Creates the internal AuthenticationManager bean which uses either the externally
registered (global) one as a parent or the bean specified by
"authentication-manager-ref".

All the providers registered by this &lt;http&gt; block will be registered with the
internal authentication manager.