Авторизация в spring security

public class JwtAuthorizationFilter extends OncePerRequestFilter {
 
    private SystemUser systemUser;
    private final AuthenticationManager authenticationManager;
 
    public JwtAuthorizationFilter(AuthenticationManager authenticationManager) {
        this.authenticationManager = authenticationManager;
    }
 
    @Override
    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws IOException, ServletException {
        Authentication authentication = getAuthentication(request);
 
        if (authentication == null) {
            filterChain.doFilter(request, response);
            return;
        }
 
        request.setAttribute("systemUser", systemUser);
 
        authenticationManager.authenticate(authentication);
 
        SecurityContextHolder.getContext().setAuthentication(authentication);
 
        filterChain.doFilter(request, response);
    }
 
    private Authentication getAuthentication(HttpServletRequest request) {
        String token = request.getHeader(SecurityConstants.TOKEN_HEADER);
 
        if (!StringUtils.isEmpty(token) && token.startsWith(SecurityConstants.TOKEN_PREFIX)) {
            byte[] signingKey = SecurityConstants.JWT_SECRET.getBytes();
            Jws<Claims> parsedToken;
 
            try {
                parsedToken = Jwts.parser()
                        .setSigningKey(signingKey)
                        .parseClaimsJws(token.replace("Bearer ", ""));
            }catch (Exception e){
                return null;
            }
 
            systemUser = new ObjectMapper().convertValue(parsedToken.getBody(), SystemUser.class);
 
            return new UsernamePasswordAuthenticationToken(systemUser.getUserId().toString(), systemUser.getCompanyId().toString(), systemUser.getGrantedAuthority());
        }
 
        return null;
    }
}

@Component
public class SystemAuthenticationProvider implements AuthenticationProvider {
    @Override
    public Authentication authenticate(Authentication authentication) throws AuthenticationException {
        if (authentication == null) {
            throw new BadCredentialsException("Authentication failed");
        } else {
            return authentication;
        }
    }
    @Override
    public boolean supports(Class<?>aClass) {
        return aClass.equals(UsernamePasswordAuthenticationToken.class);
    }
}

@Configuration
public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
    @Autowired
    private SystemAccessDeniedHandler systemAccessDeniedHandler;
    @Autowired
    private SystemAuthenticationEntryPoint systemAuthenticationEntryPoint;
    @Autowired
    private SystemAuthenticationProvider systemAuthenticationProvider;
 
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.cors()
                .and()
                    .formLogin().disable()
                    .logout().disable()
                    .csrf().disable()
                    .httpBasic().disable()
                .authorizeRequests()
                    .antMatchers(SecurityConstants.SOURCES.get(Role.NONE)).permitAll()
                    .antMatchers(SecurityConstants.SOURCES.get(Role.ARCHITECT)).hasRole(Role.ARCHITECT.name())
                    .antMatchers(SecurityConstants.SOURCES.get(Role.ADMINISTRATOR)).hasRole(Role.ADMINISTRATOR.name())
                    .anyRequest().authenticated()
                .and()
//                    .addFilter(new JwtAuthenticationFilter(authenticationManager()))
                    .addFilterBefore(new JwtAuthorizationFilter(authenticationManager()), SecurityContextPersistenceFilter.class)
                .exceptionHandling()
                    .authenticationEntryPoint(systemAuthenticationEntryPoint)
                    .accessDeniedHandler(systemAccessDeniedHandler)
                .and()
                    .sessionManagement()
                    .sessionCreationPolicy(SessionCreationPolicy.STATELESS);
    }
 
    @Override
    public void configure(AuthenticationManagerBuilder auth) {
        auth.authenticationProvider(systemAuthenticationProvider);
    }
 
    @Bean
    public CorsConfigurationSource corsConfigurationSource() {
        final UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
        source.registerCorsConfiguration("/**", new CorsConfiguration().applyPermitDefaultValues());
 
        return source;
    }
}

@Component
public class SystemAuthenticationProvider implements AuthenticationProvider {
    @Override
    public Authentication authenticate(Authentication authentication) throws AuthenticationException {
        if (authentication == null) {
            throw new BadCredentialsException("Authentication failed");
        } else {
            return authentication;
        }
    }
    @Override
    public boolean supports(Class<?>aClass) {
        return aClass.equals(UsernamePasswordAuthenticationToken.class);
    }
}

return new UsernamePasswordAuthenticationToken(systemUser.getUserId().toString(), systemUser.getCompanyId().toString(), systemUser.getGrantedAuthority());

  .addFilterBefore(new JwtAuthorizationFilter(authenticationManager()), UsernamePasswordAuthenticationFilter.class)

                    
.antMatchers(SecurityConstants.SOURCES.get(Role.NONE)).permitAll()
.antMatchers(SecurityConstants.SOURCES.get(Role.ARCHITECT)).hasRole(Role.ARCHITECT.name())
.antMatchers(SecurityConstants.SOURCES.get(Role.ADMINISTRATOR)).hasRole(Role.ADMINISTRATOR.name())

                    
.antMatchers(SecurityConstants.SOURCES.get(Role.NONE)).permitAll()
.antMatchers(SecurityConstants.SOURCES.get(Role.ADMINISTRATOR)).hasRole(Role.ADMINISTRATOR.name())
.antMatchers(SecurityConstants.SOURCES.get(Role.ARCHITECT)).hasRole(Role.ARCHITECT.name())