This is often by design. Try setting the DaoAuthenticationProvider.hideUserNotFoundExceptio ns property. Also note the code of RemoteAuthenticationManagerImpl does expose the exception message:
Code:
public GrantedAuthority[] attemptAuthentication(String username,
String password) throws RemoteAuthenticationException {
UsernamePasswordAuthenticationToken request = new UsernamePasswordAuthenticationToken(username,
password);
try {
return authenticationManager.authenticate(request).getAuthorities();
} catch (AuthenticationException authEx) {
throw new RemoteAuthenticationException(authEx.getMessage());
}
}