Cannot grant any authority?!

[kensonman]

I'm new one of both Spring and SpringSecurity. I currently develop a web-application on tomcat 6.0.18+mysql 5.0 with Spring 2.5.6 and Spring Security 2.0.4;
The spring always said "Bad credentials. I'm tried both JdbcDaoImpl and JdbcUserDetailsManager. and also, I confirm the SQL statement is valid and return 'ROLE_USER,ROLE_ADMIN' as authority;

The spring log:

......
DEBUG [http-8080-1] (JdbcTemplate.java:521) - Executing prepared SQL statement [
			SELECT 
				alias AS 'username', 
				pwd AS 'password',
				(eff_date <= now() AND (exp_date IS NULL OR exp_date > now())) AS 'enabled'
			FROM tb_admin_user
			WHERE alias=?
		]
......
DEBUG [http-8080-1] (JdbcTemplate.java:521) - Executing prepared SQL statement [
			SELECT
				alias AS 'username',
				authority AS 'authority'
			FROM tb_admin_authorities
			WHERE alias=?
		]
......
DEBUG [http-8080-1] (AbstractApplicationContext.java:244) - Publishing event in context [org.springframework.web.context.support.XmlWebApplicationContext@1ff243d1]: org.springframework.security.event.authentication.AuthenticationFailureBadCredentialsEvent[source=org.springframework.security.providers.UsernamePasswordAuthenticationToken@8a250bfa: Principal: kenson; Password: [PROTECTED]; Authenticated: false; Details: org.springframework.security.ui.WebAuthenticationDetails@12afc: RemoteIpAddress: 127.0.0.1; SessionId: F676C912473E6E1CC19C406160CC6322; Not granted any authorities]
DEBUG [http-8080-1] (AbstractProcessingFilter.java:405) - Updated SecurityContextHolder to contain null Authentication
DEBUG [http-8080-1] (AbstractProcessingFilter.java:411) - Authentication request failed: org.springframework.security.BadCredentialsException: Bad credentials

My Security Setting:

<?xml version="1.0" encoding="utf-8"?>
<beans:beans xmlns="http://www.springframework.org/schema/security" 
	xmlns:beans="http://www.springframework.org/schema/beans"
	
	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
	xsi:schemaLocation="http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-2.0.xsd
		http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-2.0.xsd">
	
	<beans:bean id="dataSource" class="org.springframework.jndi.JndiObjectFactoryBean" destroy-method="close">
		<beans:property name="jndiName" value="java:comp/env/jdbc/webappDS"/>
	</beans:bean>
	
	<beans:bean id="dbAuthProvider" class="org.springframework.security.userdetails.jdbc.JdbcUserDetailsManager">
		<beans:property name="dataSource" ref="dataSource"/>
		<beans:property name="usersByUsernameQuery"><beans:value>
			SELECT 
				alias AS 'username', 
				pwd AS 'password',
				(eff_date &lt;= now() AND (exp_date IS NULL OR exp_date &gt; now())) AS 'enabled'
			FROM tb_admin_user
			WHERE alias=?
		</beans:value></beans:property>
		<beans:property name="authoritiesByUsernameQuery"><beans:value>
			SELECT
				alias AS 'username',
				authority AS 'authority'
			FROM tb_admin_authorities
			WHERE alias=?
		</beans:value></beans:property>
		<beans:property name="enableAuthorities" value="true"/>
		<beans:property name="enableGroups" value="false"/>
	</beans:bean>
	
	<beans:bean id="md5PasswordEncoder" class="org.springframework.security.providers.encoding.Md5PasswordEncoder"/>
		
	<http auto-config="true">
		<intercept-url pattern="/scripts/*" filters="none"/>
		<intercept-url pattern="/login.jsp?*" filters="none"/>
		<intercept-url pattern="/**/*.ctrl" access="ROLE_USER"/>
		<concurrent-session-control max-sessions="1"/>
	</http>
	
	<authentication-provider user-service-ref="dbAuthProvider">
		<!-- The password should stored in database with "md5(password||'{'||username||'}')" -->
		<!-- 
		<user-service>
			<user name="kenson" password="fujitsu" authorities="ROLE_USER"/>
		</user-service>
		 --> 
		<password-encoder ref="md5PasswordEncoder"><salt-source user-property="username"/></password-encoder>
	</authentication-provider>
</beans:beans>

[kensonman]

Nobody know that? Please help!!

[Andrei Tsibets]

Can you show more log information?
Or can you find where BadCredentialsException was thrown?