Core answer
Start here. This is the direct spoken answer to practice first.
Overview
The manager coordinates authentication providers; user lookup is only one input to some providers.
An authentication filter creates an unauthenticated Authentication token from supplied credentials and passes it to an AuthenticationManager. The common manager, ProviderManager, asks configured AuthenticationProvider implementations whether they support that token type and lets an appropriate provider verify it. A username-and-password provider can use UserDetailsService to load account data and PasswordEncoder to check the password. Success returns an authenticated token with principal and authorities.