로그인Form을 submit 할 시에 스프링시큐리티의 AuthenticationProvider 인터페이스를 구현한

authenticate 메소드를 아래와같이 타게되는데요.

@Component
public class CustomAuthenticationProvider implements AuthenticationProvider {
	
	@Autowired
	CustomUserDetailsServiceImpl userService;
	
	@Override
	public Authentication authenticate(Authentication authentication) throws AuthenticationException {
		String username = authentication.getName(); 
		String password = (String) authentication.getCredentials();
		
		Member member = userService.loadUserByUsername(username);
		
		if (member == null) {
			throw new BadCredentialsException("There is no User Info.");
		}
		if (!member.getPassword().equals(password)) {
			throw new BadCredentialsException("Password does not match. Please verify correct password.");
		}
		
		Collection<? extends GrantedAuthority> authorities = member.getAuthorities();
		
		return new UsernamePasswordAuthenticationToken(member, password, authorities);
		
	}

	@Override
	public boolean supports(Class<?> authentication) {
		return  authentication.equals(UsernamePasswordAuthenticationToken.class);
	}
}

위 메소드에서 세션에 들어있는 개인키를 가져와서 password를 복호화해야되는데

위 메소드는 세션을 가져올수가 없네요..

혹시 방법이 없을까요? ( mvc interceptor preHandle은 위 메소드 이후에 호출되어 불가능..)