User roles should not be sent in PreAuthenticatedProcessingFilter.getPreAuthenticatedCredentials. Fixed it. And replaced a depricated class with a newer one.