If you need an object for the user, try a AuthenticationProcessingFilter.


public class CustomAuthenticationProcessingFilter extends AuthenticationProcessingFilter {

protected void...