title: Spring BadCredentials Event not firing
body: <p>I want to log if a user tries to authenticate with wrong credentials. Therefore i have added this event listener class to my project:</p>
  
  <pre><code>import org.slf4j.Logger;
  import org.slf4j.LoggerFactory;
  import org.springframework.context.ApplicationListener;
  import org.springframework.security.authentication.event.AuthenticationFailureBadCredentialsEvent;
  import org.springframework.stereotype.Component;
  
  @Component
  public class AuthenticationFailureListener
          implements ApplicationListener&lt;AuthenticationFailureBadCredentialsEvent&gt;{
  
      private final Logger logger = LoggerFactory.getLogger(getClass());
  
      @Override
      public void onApplicationEvent(AuthenticationFailureBadCredentialsEvent event) {
          System.out.println("test");
          logger.info("test2");
      }
  }
  </code></pre>
  
  <p>Problem is it does not work at all. I use Spring Security default login page. The page shows "bad credentials" error when using wrong credentials, but my method above does not get called.
  I have very similar code for a success event listener, which works wonderfully:</p>
  
  <pre><code>@Component
  public class AuthenticationSuccessListener implements
          ApplicationListener&lt;InteractiveAuthenticationSuccessEvent&gt; {
  
      private final Logger logger = LoggerFactory.getLogger(getClass());
  
      @Autowired private UserService users;
  
      @Override
      public void onApplicationEvent(InteractiveAuthenticationSuccessEvent event) {
          User user = users.get(event.getAuthentication().getName());
          boolean isAdmin = user.getRole().equals(User.ROLE_ADMIN);
          logger.info((isAdmin ? "Admin" : "User") + " with id " + user.getIdLink()
                  + " has successfully logged in!");
      }
  }
  </code></pre>
  
  <p>Here is my Spring Security Java Configuration:</p>
  
  <pre><code>@Configuration
  @EnableWebMvcSecurity
  @EnableGlobalMethodSecurity(prePostEnabled=true)
  public class SecurityConfiguration extends WebSecurityConfigurerAdapter{
  
      @Autowired
      private CustomUserDetailsService userDetailsService;
  
      @Bean
      public PasswordEncoder passwordEncoder() {
          return new BCryptPasswordEncoder();
      }
  
      @Autowired
      public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
          auth
              .userDetailsService(userDetailsService).passwordEncoder(passwordEncoder());
      }
  
      protected void configure(HttpSecurity http) throws Exception {
          http
              .csrf().disable()
              .formLogin()
                  .and()
              .httpBasic();
      }
  }
  </code></pre>
  
  <p>I have no clue whats going on here, help appreciated a lot!</p>
  
  <p>Spring version: 4.0.9<br>
  Spring Security version: 3.2.5 (also tried 4.0.1)</p>
  
  <hr>
  
  <p>Edit:</p>
  
  <p>Okay, i set log level to DEBUG for Spring, but nothing. I searched for every occurance of "Listener" and the log states that instances of AuthenticationFailureListener as well as AuthenticationSuccessListeners have been created without any error.  </p>
  
  <p>I even put the log into diff tool (after replacing all times &amp; censoring) and compared with a code version where FailureListener code is commented out, but didn't find something. You can search it yourself if you want to:<br>
  <a href="https://www.diffchecker.com/cwdn4sp4" rel="noreferrer">https://www.diffchecker.com/cwdn4sp4</a><br>
  On the bottom of the page you will find the plain log text on the left side.</p>
  
  <hr>
  
  <p>Edit2: <strong>Partly Solved</strong></p>
  
  <p>Serges solution helped, here is my complete implementation of the onAuthenticationFailure method:</p>
  
  <pre><code>@Override
  public void onAuthenticationFailure(
          HttpServletRequest request, HttpServletResponse response,
          AuthenticationException exception) throws IOException, ServletException {
  
      if (exception instanceof BadCredentialsException) {
          String name = request.getParameter("username");
          String password = request.getParameter("password");
          Authentication auth =
                  new UsernamePasswordAuthenticationToken(name, password);
          eventPublisher.publishEvent(
                  new AuthenticationFailureBadCredentialsEvent(auth, exception));
      }
      super.onAuthenticationFailure(request, response, exception);
  }
  </code></pre>