Spring Security login fails despite correct username and password

Good morning, I have encountered problem with logging into app which uses Spring Security. Every time i try to log in (even though username and password are correct), app redirects me to failure url (in my case it's: /login?error=true). Passwords are encrypted with BCrypt and I'm using MySQL Database to store them.

App is based on code from Spring in Action 5:
<https://github.com/habuma/spring-in-action-5-samples/tree/master/ch04/tacos>

My code:

User class

@Entity
@Data
@NoArgsConstructor
@Table(name = "Users")
public class User implements UserDetails {

    @Id
    @GeneratedValue(strategy = GenerationType.IDENTITY)
    private Long id;
    private String username;
    private String password;
    private String email;

    public User(String username, String password, String email) {
        this.username = username;
        this.password = password;
        this.email = email;
    }

    @Override
    public Collection<? extends GrantedAuthority> getAuthorities() {
        return null;
    }

    @Override
    public boolean isAccountNonExpired() {
        return false;
    }

    @Override
    public boolean isAccountNonLocked() {
        return false;
    }

    @Override
    public boolean isCredentialsNonExpired() {
        return false;
    }

    @Override
    public boolean isEnabled() {
        return false;
    }

}

Security configuration

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Qualifier("userService")
    @Autowired
    private UserDetailsService userDetailsService;

    @Bean
    public PasswordEncoder encoder() {
        return new BCryptPasswordEncoder();
    }

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception{
        auth.userDetailsService(userDetailsService)
            .passwordEncoder(encoder());
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception{
        http.authorizeRequests()
                .antMatchers("/calendar")
                    .hasRole("USER")
                .antMatchers("/","/**").permitAll()
                .and()
                    .formLogin()
                        .loginPage("/login")
                        .defaultSuccessUrl("/calendar")
                        .failureUrl("/login?error=true")
                .and()
                    .logout()
                        .logoutSuccessUrl("/");
    }

}

User service

@Service
public class UserService implements UserDetailsService {

    private UserRepository userRepository;

    @Autowired
    public UserService(UserRepository userRepository){
        this.userRepository = userRepository;
    }

    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        User user = userRepository.findByUsername(username);
        if(user != null){
            return user;
        }
        throw new UsernameNotFoundException("Username not found: "+username);
    }
}

Controller

@Controller
@RequestMapping("/register")
public class UserController {

    private UserRepository userRepository;
    private PasswordEncoder passwordEncoder;

    @Autowired
    public UserController(UserRepository userRepository, PasswordEncoder passwordEncoder){
        this.userRepository = userRepository;
        this.passwordEncoder = passwordEncoder;
    }

    @ModelAttribute
    public void calendar(Model model){
        model.addAttribute("user", new User());
    }

    @GetMapping
    public String register(){
        return "register";
    }

    @PostMapping
    public String addUser(@ModelAttribute User user){
        User newUser = new User(user.getUsername(),passwordEncoder.encode(user.getPassword()),user.getEmail());
        userRepository.save(newUser);
        return "redirect:/login";
    }

}

Login form (Thymeleaf)

    <form th:method="POST" th:action="@{/login}">
        <div class="formInputs">
            <label for="username">Username</label>
            <input id="username" name="username" type="text">
        </div>
        <div class="formInputs">
            <label for="password">Password</label>
            <input id="password" name="password" type="password">
        </div>
        <div style="clear: both"></div>
        <input type="submit" value="Log in">
    </form>

Registration form

<form method="POST" th:action="@{/register}" th:object="${user}">
            <div class="formInputs">
                <label for="username">Username</label>
                <input id="username" type="text" th:field="*{username}">
            </div>
            <div class="formInputs">
                <label for="password">Password</label>
                <input id="password" type="password" th:field="*{password}">
            </div>
            <div class="formInputs">
                <label for="email">Email</label>
                <input id="email" type="email" th:field="*{email}">
            </div>
            <div style="clear: both"></div>
            <input type="submit" value="Register">
            <input type="reset" value="Reset">
        </form>

If someone could help me find a solution i would be grateful, thank you in advance.

Make sure your user returns enabled = true, as well as isAccountNonExpired = true (and all others as well, like isAccountNonLocked). Also return an empty list of authorities, not null.

Otherwise Spring Security will treat your user as disabled/locked/whatever and not allow you to login.