Login fails when using char[] instead of String for password credentials

When using UsernamePasswordAuthenticationToken with a char[] password instead of a String, authentication fails.

From a security perspective, it is recommended to use char[] to avoid leaving password values in immutable String objects in memory. However, Spring Security seems to implicitly assume passwords are String values during credential comparison, which causes login to fail when char[] is provided.

To Reproduce

1. Create an authentication attempt using UsernamePasswordAuthenticationToken("user", passwordCharArray), where passwordCharArray is a char[].

2. Configure a standard DaoAuthenticationProvider with a UserDetailsService and password encoder.

3. Attempt login.

4. Authentication fails, even if the char[] contains the correct password.

Expected behavior
Spring Security should either:

Support char[] as password credentials in AuthenticationToken, or

Explicitly document that only String credentials are supported (and that callers must convert to String).

Supporting char[] would allow applications to follow secure coding practices and minimize the lifetime of passwords in memory.

Sample

char[] password = "password".toCharArray();
Authentication auth = new UsernamePasswordAuthenticationToken("user", password);
Authentication result = authenticationManager.authenticate(auth);

Result: Authentication fails.
If changed to String password = "password";, authentication succeeds.

Start at UsernamePasswordAuthenticationToken credential handling and follow the DaoAuthenticationProvider authentication path using the supplied char[] reproduction. Compare that behavior with String credentials and determine whether the issue should support char[] or document String-only credentials; done when the chosen behavior is covered by the relevant authentication checks.