Ability to use AbstractAuthenticationFilterConfigurer for custom filters

Expected Behavior

A new custom auth processor can be added by implementing AbstractAuthenticationFilterConfigurer and AbstractAuthenticationProcessingFilter.

Current Behavior

Trying to do this fails, as AbstractAuthenticationFilterConfigurer calls http.addFilter() at the end of its quite long configure() method, which fails on any non-builtin filter.

Context

Specifically I was adding a system to force a password change if credentials are expired.
After the CredentialsExpiredException is handled, there is another POST request with the new password, which should go through all the same "authentication success" steps when it completes. The way to do this appears to be to implement an AbstractAuthenticationProcessingFilter, but to ensure it's configured correctly you need to either copy-paste a lot of AbstractAuthenticationFilterConfigurer, or do this:

@Override
public void configure(HttpSecurity http) {
    try {
        super.configure(http);
    } catch (IllegalArgumentException ex) {
        http.addFilterAfter(getAuthenticationFilter(), UsernamePasswordAuthenticationFilter.class);
    }
}

Some way to define the order of a custom filter (e.g. another protected method in AbstractAuthenticationFilterConfigurer) would fix this.

Start by reading AbstractAuthenticationFilterConfigurer and AbstractAuthenticationProcessingFilter, focusing on configure(HttpSecurity) and the current http.addFilter() call. Determine how custom filter ordering can be exposed without the exception, then verify that a custom authentication filter configures successfully and is placed at the requested position.