AuthenticationManager is the core interface Spring Security calls to authenticate a request, and ProviderManager is its default implementation, which delegates the actual credential check to one or more AuthenticationProvider instances until one succeeds.
Key Points: • AuthenticationManager.authenticate(Authentication) either returns a fully populated, authenticated Authentication object or throws an AuthenticationException. • ProviderManager holds a list of AuthenticationProviders and tries each one that supports the given Authentication type. • This design lets an application support multiple authentication sources—database, LDAP, in-memory—simultaneously. • If no provider can authenticate the request, ProviderManager throws a ProviderNotFoundException. • A parent ProviderManager can be configured to share common providers across multiple authentication managers.
Example: An application configures both a DaoAuthenticationProvider (checking a database) and an LdapAuthenticationProvider; ProviderManager tries each in turn until one successfully authenticates the user.
Interview Tip: A concise interview answer is:
"AuthenticationManager is the interface Spring Security calls to authenticate a request, and ProviderManager is its standard implementation that delegates to a chain of AuthenticationProviders, trying each one until it finds one that can handle and validate the credentials. This lets you plug in multiple authentication sources like database and LDAP side by side."