user --------------- /app/list_resource 
                          |
                          v
                   filter: DelegatingFilterProxy
                          |
                          v
                  <http form-login@login-page: /my_login  (1)
                          |
                          v
                  Controller.login(String error, String logout)
                          |
                          v
                  View: login.jsp         action="/where_?"
                       (user's input)  -------------------> match (2) in xml? --no-->  A: (custom process)
                                                                    |
                                                                   yes
                                                                    |
                                                                    v
                                                    B: processed by Spring: <authentication-manager>
                                                                    |

@RequestMapping(value = "/where_to_process_login_custom", method = RequestMethod.POST)
public ModelAndView login_process(@RequestParam String username, @RequestParam String password, HttpSession session){
	/* your custom implementation here ... */
}

@Configuration
@EnableWebSecurity
public class DBSecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    private UserDetailsService userDetailsService; 

    @Override
    protected void configure(HttpSecurity http) throws Exception {
	/* http.authorizeRequests.configuration ... */
    }
	
	
    // XML counterpart (if not defined here by WebSecurityConfigurerAdapter):
    // 	<authentication-manager>
    //     <authentication-provider ref="customAuthenticationProvider" />
    //  </authentication-manager>
    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception 
    {
        auth.authenticationProvider(
		    getAuthenticationProvider() // <-- your own provider here
		);  
    }

    @Bean 
    public DaoAuthenticationProvider getAuthenticationProvider(){
        DaoAuthenticationProvider auth = new DaoAuthenticationProvider();
        auth.setUserDetailsService(userDetailsService);
        auth.setPasswordEncoder(passwordEncoder());
        return auth;
    }
    
    @Bean
    public BCryptPasswordEncoder passwordEncoder(){
        return new BCryptPasswordEncoder();
    }
    
}