ProviderManager keeps trying other providers when CAS login fails

Summary

With multiple providers configured, say DaoAuthenticationProvider and CasAuthenticationProvider, when CAS login fails, ProviderManager keep trying other providers.

Actual Behavior

When a failed CAS login occurs, INVALID_TICKET for example, ProviderManager keep trying other providers configured, like DaoAuthenticationProvider, that uses the same authentication token class UsernamePasswordAuthenticationToken, which cause a BadCredentialsException to be the lastException on the iteration.
I don't know if the providers order can change something here.

Expected Behavior

CAS failed authentication should not try other providers.
A simple solution would be to create a different class from UsernamePasswordAuthenticationToken to use on CasAuthenticationFilter and CAS related authentication.
This will cause ProviderManager not to try other providers when the request is from a CAS server.

Configuration

Not available.

Version

4.1.3.RELEASE

Sample

Not available.

Trace ProviderManager's provider iteration with DaoAuthenticationProvider and CasAuthenticationProvider, then inspect how CasAuthenticationFilter creates UsernamePasswordAuthenticationToken. Reproduce the failed CAS login with multiple providers if possible; done means CAS authentication failures no longer fall through to other providers while normal provider selection still works.