title: Spring security UsernamePasswordAuthenticationFilter with remember-me
body: <p>I want to add the remember-me into my login page, by reading <a href="http://static.springsource.org/spring-security/site/docs/3.0.x/reference/remember-me.html" rel="nofollow">here</a> , it needs a UserDetailsService. But my UserDetailsService is not getting called, can anyone point where i am wrong? Thanks.</p>
  
  <p>The spring-security.xml</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt; &lt;beans xmlns="http://www.springframework.org/schema/beans"
  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
  xmlns:security="http://www.springframework.org/schema/security"
  xmlns:p="http://www.springframework.org/schema/p" 
  xsi:schemaLocation="http://www.springframework.org/schema/beans 
          http://www.springframework.org/schema/beans/spring-beans-3.1.xsd
          http://www.springframework.org/schema/security 
          http://www.springframework.org/schema/security/spring-security-3.1.xsd"&gt;
  
  &lt;!-- configure Spring-Security  
  auto-config is false.
  use-expressions is true: see http://static.springsource.org/spring-security/site/docs/3.1.x/reference/el-access.html
  access-denied-page: which page is redirected when login is denied
  entry-point-ref: This attribute allows this behaviour to be overridden by defining a customized 
  AuthenticationEntryPoint bean which will start the authentication process   
  --&gt;
  
  &lt;security:http auto-config="false" use-expressions="true" entry-point-ref="authenticationEntryPoint" &gt;
  
      &lt;!-- define how to handle the url /auth/login, primitAll is used since we defined use-expressions=true --&gt;
      &lt;security:intercept-url pattern="/login" access="permitAll"/&gt;
      &lt;security:intercept-url pattern="/search" access="hasRole('ROLE_USER')"/&gt;
  
      &lt;!-- The logout element adds support for logging out by navigating to a particular URL. 
      The default logout URL is /j_spring_security_logout, 
      but you can set it to something else using the logout-url attribute --&gt;
      &lt;security:logout 
              invalidate-session="true" 
              logout-success-url="/login" /&gt;
  
      &lt;security:custom-filter ref="blacklistFilter" before="FILTER_SECURITY_INTERCEPTOR"/&gt;
      &lt;security:custom-filter ref="authenticationFilter" position="FORM_LOGIN_FILTER"/&gt;
  &lt;/security:http&gt;
  
  &lt;!--  Custom filter to deny unwanted users even though registered --&gt;
  &lt;bean id="blacklistFilter" class="com.myapp.filter.BlacklistFilter" /&gt;
  
  &lt;!-- Custom filter for username and password. we need to create another 4 beans --&gt;
  &lt;bean id="authenticationFilter" class="org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter"
      p:rememberMeServices-ref="rememberMeServices"
      p:authenticationManager-ref="customAuthenticationManager"
      p:authenticationFailureHandler-ref="customAuthenticationFailureHandler"
      p:authenticationSuccessHandler-ref="customAuthenticationSuccessHandler" /&gt;
  
  &lt;!-- Bean 1: Custom authentication manager. --&gt;
  &lt;bean id="customAuthenticationManager" class="com.myapp.manager.CustomAuthenticationManager" /&gt;
  
  &lt;!-- bean 2: set the default failure url here --&gt;
  &lt;bean id="customAuthenticationFailureHandler" class="org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler"
      p:defaultFailureUrl="/login?error=true" /&gt;
  
   &lt;!-- bean 3: set the default target url here --&gt;
  &lt;bean id="customAuthenticationSuccessHandler" class="org.springframework.security.web.authentication.SimpleUrlAuthenticationSuccessHandler"
      p:defaultTargetUrl="/search" /&gt;
  
  &lt;!-- bean 4: remember me --&gt;
  &lt;bean id="rememberMeServices"
      class="org.springframework.security.web.authentication.rememberme.TokenBasedRememberMeServices"&gt;
          &lt;property name="userDetailsService" ref="userDetailsService"/&gt;
          &lt;property name="key" value="myapp"/&gt;
  &lt;/bean&gt;
  
  &lt;bean id="userDetailsService" class="com.myapp.service.UserDetailsServiceImpl" /&gt;
  
  &lt;bean id="authenticationEntryPoint"  class="org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint"
      p:loginFormUrl="/login"/&gt;
  &lt;security:authentication-manager/&gt;&lt;/beans&gt;
  </code></pre>
  
  <p>Thanks, Ralph</p>
  
  <p>I added the filter, but UserDetailsServiceImpl is still not called, there is a stop point.</p>
  
  <p><code>public UserDetails loadUserByUsername(String email)
              throws UsernameNotFoundException {
          logger.info("User details service is called");
          return null;
      }</code> </p>
  
  <p>and now the configuration is :</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;&lt;beans xmlns="http://www.springframework.org/schema/beans"
  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
  xmlns:security="http://www.springframework.org/schema/security"
  xmlns:p="http://www.springframework.org/schema/p" 
  xsi:schemaLocation="http://www.springframework.org/schema/beans 
          http://www.springframework.org/schema/beans/spring-beans-3.1.xsd
          http://www.springframework.org/schema/security 
          http://www.springframework.org/schema/security/spring-security-3.1.xsd"&gt;
  
  &lt;!-- configure Spring-Security  
  auto-config is false.
  use-expressions is true: see http://static.springsource.org/spring-security/site/docs/3.1.x/reference/el-access.html
  access-denied-page: which page is redirected when login is denied
  entry-point-ref: This attribute allows this behaviour to be overridden by defining a customized 
  AuthenticationEntryPoint bean which will start the authentication process   
  --&gt;
  
  &lt;security:http auto-config="false" use-expressions="true" entry-point-ref="authenticationEntryPoint" &gt;
  
      &lt;!-- define how to handle the url /auth/login, primitAll is used since we defined use-expressions=true --&gt;
      &lt;security:intercept-url pattern="/login" access="permitAll"/&gt;
      &lt;security:intercept-url pattern="/search" access="hasRole('ROLE_USER')"/&gt;
  
      &lt;!-- The logout element adds support for logging out by navigating to a particular URL. 
      The default logout URL is /j_spring_security_logout, 
      but you can set it to something else using the logout-url attribute --&gt;
      &lt;security:logout 
              invalidate-session="true" 
              logout-success-url="/login" /&gt;
  
      &lt;security:custom-filter ref="blacklistFilter" before="FILTER_SECURITY_INTERCEPTOR"/&gt;
      &lt;security:custom-filter ref="authenticationFilter" position="FORM_LOGIN_FILTER"/&gt;
      &lt;security:custom-filter ref="rememberMeFilter" position="REMEMBER_ME_FILTER"/&gt;
  &lt;/security:http&gt;
  
  &lt;!--  Custom filter to deny unwanted users even though registered --&gt;
  &lt;bean id="blacklistFilter" class="com.myapp.filter.BlacklistFilter" /&gt;
  
  &lt;!-- Custom filter for username and password. we need to create another 4 beans --&gt;
  &lt;bean id="authenticationFilter" class="org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter"
  
      p:rememberMeServices-ref="rememberMeServices"
      p:authenticationManager-ref="customAuthenticationManager"
      p:authenticationFailureHandler-ref="customAuthenticationFailureHandler"
      p:authenticationSuccessHandler-ref="customAuthenticationSuccessHandler" /&gt;
  
  &lt;!-- Bean 1: Custom authentication manager. --&gt;
  &lt;bean id="customAuthenticationManager" class="com.myapp.manager.CustomAuthenticationManager" /&gt;
  
  &lt;!-- bean 2: set the default failure url here --&gt;
  &lt;bean id="customAuthenticationFailureHandler" class="org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler"
      p:defaultFailureUrl="/login?error=true" /&gt;
  
   &lt;!-- bean 3: set the default target url here --&gt;
  &lt;bean id="customAuthenticationSuccessHandler" class="org.springframework.security.web.authentication.SimpleUrlAuthenticationSuccessHandler"
      p:defaultTargetUrl="/search" /&gt;
  
  &lt;!-- bean 4: remember me --&gt;
  &lt;bean id="rememberMeServices"
      class="org.springframework.security.web.authentication.rememberme.TokenBasedRememberMeServices"&gt;
          &lt;property name="userDetailsService" ref="userDetailsService"/&gt;
          &lt;property name="key" value="myapp"/&gt;
  &lt;/bean&gt;
  
  &lt;bean id="userDetailsService" class="com.myapp.service.UserDetailsServiceImpl" /&gt;
  
  
  &lt;bean id="rememberMeFilter" class="org.springframework.security.web.authentication.rememberme.RememberMeAuthenticationFilter"&gt;
      &lt;property name="rememberMeServices" ref="rememberMeServices"/&gt;
      &lt;property name="authenticationManager" ref="customAuthenticationManager" /&gt;
  &lt;/bean&gt;
  
  &lt;bean id="authenticationEntryPoint"  class="org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint"
      p:loginFormUrl="/login"/&gt;
  
  &lt;security:authentication-manager alias="theAuthenticationManager"/&gt;&lt;/beans&gt;
  </code></pre>