code: protected void unsuccessfulAuthentication(PortletRequest request, PortletResponse response,
              AuthenticationException failed) {
          SecurityContextHolder.clearContext();
  
          if (logger.isDebugEnabled()) {
              logger.debug("Cleared security context due to exception", failed);
          }
          request.setAttribute(WebAttributes.AUTHENTICATION_EXCEPTION, failed);
      }
docs: Ensures the authentication object in the secure context is set to null when authentication fails.
  <p>
  Caches the failure exception as a request attribute
  
  @param request a {@link javax.portlet.PortletRequest} object.
  @param response a {@link javax.portlet.PortletResponse} object.
  @param failed a {@link org.springframework.security.core.AuthenticationException} object.