Force Spring protection to verify credentials before account status flags

Question

I subclassed org.springframework.security.core.userdetails.User and in my constructor I call:

Super (String username, String password, boolean enabled, boolean accountNonExpired, boolean credentialsNonExpired, boolean accountNonLocked, GrantedAuthority[] authorities) 

Then I use ${SPRING_SECURITY_LAST_EXCEPTION.message} to display the result when the login ${SPRING_SECURITY_LAST_EXCEPTION.message} .

The problem is that if I set accountNotLocked to false, I get an account lock error message, and this happens regardless of whether the password is correct. I would prefer this if the spring credentials were checked first and then enabled, the AccountNonExpired, credentialsNonExpired and accountNonLocked accounts. Thus, the user will only be notified that their account has been locked if they have gained access rights.

Is there any way to get spring to do this?

Answer 1

I assume that you are using the most popular DaoAuthenticationProvider and the problem is the default UserDetailsChecker in this class. However, moving all the checks after DaoAuthenticationProvider.additionalAuthenticationChecks should be sufficient to solve your problem. Try the following configuration:

 <authentication-manager alias="authenticationManager"> <authentication-provider ref="daoAuthenticationProvider" /> </authentication-manager> <bean id="daoAuthenticationProvider" class="org.springframework.security.authentication.dao.DaoAuthenticationProvider"> <property name="userDetailsService" ref="userDetailsService"/> <property name="passwordEncoder" ref="passwordEncoder"/> <property name="preAuthenticationChecks" class="com.example.NullUserDetailsChecker"/> <property name="postAuthenticationChecks" class="org.springframework.security.authentication.AccountStatusUserDetailsChecker"/> </bean> 

where com.example.NullUserDetailsChecker null object pattern is an implementation of UserDetailsChecker (has a void check method that does nothing).