public DaoAuthenticationProvider(UserDetailsService userDetailsService) {
        this.userDetailsPasswordService = UserDetailsPasswordService.NOOP;
        Assert.notNull(userDetailsService, "userDetailsService cannot be null");
        this.userDetailsService = userDetailsService;
    }
......
protected Authentication createSuccessAuthentication(Object principal, Authentication authentication, UserDetails user) {
        Assert.notNull(authentication.getCredentials(), "Authentication.getCredentials() cannot be null");
        String presentedPassword = authentication.getCredentials().toString();
        boolean isPasswordCompromised = this.compromisedPasswordChecker != null && this.compromisedPasswordChecker.check(presentedPassword).isCompromised();
        if (isPasswordCompromised) {
            throw new CompromisedPasswordException("The provided password is compromised, please change your password");
        } else {
            String existingEncodedPassword = user.getPassword();
            boolean upgradeEncoding = existingEncodedPassword != null && this.userDetailsPasswordService != null && ((PasswordEncoder)this.passwordEncoder.get()).upgradeEncoding(existingEncodedPassword);
            if (upgradeEncoding) {
                String newPassword = ((PasswordEncoder)this.passwordEncoder.get()).encode(presentedPassword);
                user = this.userDetailsPasswordService.updatePassword(user, newPassword);
            }

            return super.createSuccessAuthentication(principal, authentication, user);
        }
    }

boolean upgradeEncoding = existingEncodedPassword != null && !Objects.equals(this.userDetailsPasswordService,UserDetailsPasswordService.NOOP) && ((PasswordEncoder)this.passwordEncoder.get()).upgradeEncoding(existingEncodedPassword);