I must have zipped without recursion... sorry.
I have blogged about a Form Based Acegi Solution if interested.
It's me again. I found the problem. It was that in my SimpleUserDetailsService, I did not give the UserDetails any GrantedAuthorities. Now it works fine.
Yet I have another question. As I saw in your securityContext, there should not be any session created. So that every request should be asking the credentials again. Though I disactivated all cookies in IE, I don't get the credential box when I click on links inside my site. Do you know why ?
Basic authentication relies on a header called 'Authorization' to contain the user credentials and verified on every request.
When you enters basic-authentication credentials in a browser, the browser remembers the credentials and it will send those along with every request.
That is why you won't be prompted for credentials when requesting other pages.
The no session setting will not prevent this.
Yeah, that is a very good example. It really helped me out. Thanks!!!