title: Short-cut/Bypass Spring Security 2.0 authentication using custom AuthenticationManager
body: <p>For an existing working app, I want to provide a secondary AuthenticationProvider, probably with a <a href="http://static.springsource.org/spring-security/site/docs/2.0.x/apidocs/org/springframework/security/providers/dao/DaoAuthenticationProvider.html" rel="nofollow noreferrer">DaoAuthenticationProvider</a>. Let's say it's for authenticating a "back up" password, or a prior password that was changed due to strict password policies and the user forgot the new password. ;-)</p>
  
  <p>For proof of concept, what would the implementation look like for this secondaryAuthenticationProvider that will always authenticate the user regardless of the incoming credentials? (something that returns an authenticated <a href="http://static.springsource.org/spring-security/site/docs/2.0.x/apidocs/org/springframework/security/Authentication.html" rel="nofollow noreferrer">Authentication</a> object)</p>
  
  <p>Which one of the MANY <a href="http://static.springsource.org/spring-security/site/docs/2.0.x/apidocs/org/springframework/security/providers/package-frame.html" rel="nofollow noreferrer">org.springframework.security.providers</a> &amp; subpackage classes and methods should I look at?</p>
  
  <p>Example config:</p>
  
  <pre><code>&lt;bean id="authenticationManager" class="org.springframework.security.providers.ProviderManager"&gt;
    &lt;property name="providers"&gt;
      &lt;list&gt;
        &lt;ref local="daoAuthenticationProvider"/&gt;
        &lt;ref local="secondaryAuthenticationProvider"/&gt; &lt;!-- new AuthProv --&gt;
        &lt;ref local="rememberMeAuthenticationProvider"/&gt;
      &lt;/list&gt;
    &lt;/property&gt;
  &lt;/bean&gt;
  </code></pre>