SEC-218: Fix authentication exception cleanup of SecurityContextHolder.

core/src/main/java/org/acegisecurity/ui/rememberme/RememberMeProcessingFilter.java

@@ -129,18 +129,6 @@ public class RememberMeProcessingFilter implements Filter, InitializingBean,
                 // Attempt authenticaton via AuthenticationManager
                 try {
                     authenticationManager.authenticate(rememberMeAuth);
-                } catch (AuthenticationException authenticationException) {
-                    if (logger.isDebugEnabled()) {
-                        logger.debug(
-                            "SecurityContextHolder not populated with remember-me token, as AuthenticationManager rejected Authentication returned by RememberMeServices: '"
-                            + rememberMeAuth
-                            + "'; invalidating remember-me token",
-                            authenticationException);
-                    }
-
-                    rememberMeServices.loginFail(httpRequest, httpResponse);
-                    chain.doFilter(request, response);
-                }
                     
                     // Store to SecurityContextHolder
                     SecurityContextHolder.getContext()
@@ -160,6 +148,18 @@ public class RememberMeProcessingFilter implements Filter, InitializingBean,
                                                      .getAuthentication(),
                                 this.getClass()));
                     }
+                } catch (AuthenticationException authenticationException) {
+                    if (logger.isDebugEnabled()) {
+                        logger.debug(
+                            "SecurityContextHolder not populated with remember-me token, as AuthenticationManager rejected Authentication returned by RememberMeServices: '"
+                            + rememberMeAuth
+                            + "'; invalidating remember-me token",
+                            authenticationException);
+                    }
+
+                    rememberMeServices.loginFail(httpRequest, httpResponse);
+                }
+
             }
 
             chain.doFilter(request, response);