Fala ai Guilherme, beleza?

Já tive o mesmo problema, resolvi da seguinte maneira:

1. Primeiro busco o usuário apenas pelo login.
2. Decodifico a senha do usuário encontrado (se encontrado) e comparo com a senha fornecida.

Espero ter ajudado.

Então Matheus, fiz isto, mas não funcionou.

Teria que ver os códigos Guilherme, sem ver fica complicado tentar ajudar.

Assim está a configuração do spring security

package br.com.netsoft.configuracao.auth;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.http.HttpMethod;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.builders.WebSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.config.http.SessionCreationPolicy;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
import org.springframework.web.cors.CorsConfiguration;
import org.springframework.web.cors.CorsConfigurationSource;
import org.springframework.web.cors.UrlBasedCorsConfigurationSource;

@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    private JwtAuthenticationEntryPoint unauthorizedHandler;

    @Autowired
    private JwtTokenUtil jwtTokenUtil;

    @Autowired
    private JwtUserDetailsService jwtUserDetailsService;

    @Value("${jwt.header}")
    private String tokenHeader;

    @Value("${jwt.route.authentication.path}")
    private String authenticationPath;

    @Autowired
    public void configureGlobal(AuthenticationManagerBuilder auth)
            throws Exception {
        auth.userDetailsService(jwtUserDetailsService).passwordEncoder(
                passwordEncoderBean());
    }

    @Bean
    public PasswordEncoder passwordEncoderBean() {
        return new BCryptPasswordEncoder();
    }

    @Bean
    @Override
    public AuthenticationManager authenticationManagerBean() throws Exception {
        return super.authenticationManagerBean();
    }

    @Override
    protected void configure(HttpSecurity httpSecurity) throws Exception {
        httpSecurity
                // we don't need CSRF because our token is invulnerable
                .csrf()
                .disable()

                .exceptionHandling()
                .authenticationEntryPoint(unauthorizedHandler)
                .and()

                // don't create session
                .sessionManagement()
                .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
                .and()

                .authorizeRequests()

                // Un-secure H2 Database
                // .antMatchers("/h2-console/**/**").permitAll()
                .antMatchers("/login/**")
                .permitAll()
                // ROLE_DES_ADMINISTRADOR
                .antMatchers("/admin/**")
                .access("hasRole('ROLE_DES_ADMINISTRADOR')").anyRequest()
                .authenticated();

        // Custom JWT based security filter
        JwtAuthorizationTokenFilter authenticationTokenFilter = new JwtAuthorizationTokenFilter(
                userDetailsService(), jwtTokenUtil, tokenHeader);
        httpSecurity.addFilterBefore(authenticationTokenFilter,
                UsernamePasswordAuthenticationFilter.class);

        // disable page caching
        httpSecurity.headers().frameOptions().sameOrigin() // required to set
                // for H2 else H2
                // Console will be
                // blank.
                .cacheControl();
    }

    @Override
    public void configure(WebSecurity web) throws Exception {
        // AuthenticationTokenFilter will ignore the below paths
        web.ignoring()
                .antMatchers(HttpMethod.POST, authenticationPath)

                // allow anonymous resource requests
                .and()
                .ignoring()
                .antMatchers(HttpMethod.GET, "/", "/*.html", "/favicon.ico",
                        "/**/*.html", "/**/*.css", "/**/*.js")

                // Un-secure H2 Database (for testing purposes, H2 console
                // shouldn't be unprotected in production)
                .and().ignoring().antMatchers("/h2-console/**/**");
    }

    @Bean
    public CorsConfigurationSource corsConfigurationSource() {
        CorsConfiguration configuration = new CorsConfiguration();
        configuration.setAllowCredentials(true);
        configuration.addAllowedOrigin("*");
        configuration.addAllowedHeader("*");
        configuration.addAllowedMethod("*");
        UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
        source.registerCorsConfiguration("/admin/**", configuration);
        return source;
    }

}

Do login está assim:

@PostMapping(value = "/autenticar", produces = MediaType.APPLICATION_JSON_UTF8_VALUE)
    public LoginResponse autenticar(@RequestBody UsuarioEntity entidade)
            throws ServletException {
        LoginResponse loginResponse = new LoginResponse();
        try {
            entidade.setLogin(StringUtil.removeMascara(entidade.getLogin()));
            if (StringUtil.isNuloVazio(entidade.getLogin())
                    || StringUtil.isNuloVazio(entidade.getSenha())) {
                throw new ServletException(
                        "Usuário ou senha são obrigatórios !");
            }
            Set<UsuarioEntity> entidades = usuarioServico.listar(0, 1,
                    entidade, null, new String[0]);
            if (entidades.size() == 0) {
                throw new ServletException("Usuário ou senha incorretos !");
            }
            UsuarioEntity usuarioLogado = entidades.iterator().next();
loginResponse.setToken(token(usuarioLogado));
            loginResponse.setUsuario(usuarioLogado.getId().toString());
            loginResponse.setNomeUsuario(usuarioLogado.getLoginFormatado()
                    + " - " + usuarioLogado.getNome());
            loginResponse.setGrupo(usuarioLogado.getUsuariosGrupos().iterator()
                    .next().getGrupo().getRole());

        } catch (Exception e) {
            logger.error("", e);
        }
        return loginResponse;
    }

Estranho quando o sistema não era em angular, e sim em html com thymeleaf, eu só entrava com o login e senha (digitada) e o spring validava o restante. Não precisava validar a senha.