diff --git a/core/src/main/java/org/acegisecurity/providers/dao/DaoAuthenticationProvider.java b/core/src/main/java/org/acegisecurity/providers/dao/DaoAuthenticationProvider.java index b9d5ce16f4..189600a638 100644 --- a/core/src/main/java/org/acegisecurity/providers/dao/DaoAuthenticationProvider.java +++ b/core/src/main/java/org/acegisecurity/providers/dao/DaoAuthenticationProvider.java @@ -237,24 +237,6 @@ public class DaoAuthenticationProvider implements AuthenticationProvider, } } - if (!user.isEnabled()) { - if (this.context != null) { - context.publishEvent(new AuthenticationFailureDisabledEvent( - authentication, user)); - } - - throw new DisabledException("User is disabled"); - } - - if (!user.isAccountNonExpired()) { - if (this.context != null) { - context.publishEvent(new AuthenticationFailureAccountExpiredEvent( - authentication, user)); - } - - throw new AccountExpiredException("User account has expired"); - } - if (!user.isAccountNonLocked()) { if (this.context != null) { context.publishEvent(new AuthenticationFailureAccountLockedEvent( @@ -281,7 +263,25 @@ public class DaoAuthenticationProvider implements AuthenticationProvider, } } - if (!user.isCredentialsNonExpired()) { + if (!user.isEnabled()) { + if (this.context != null) { + context.publishEvent(new AuthenticationFailureDisabledEvent( + authentication, user)); + } + + throw new DisabledException("User is disabled"); + } + + if (!user.isAccountNonExpired()) { + if (this.context != null) { + context.publishEvent(new AuthenticationFailureAccountExpiredEvent( + authentication, user)); + } + + throw new AccountExpiredException("User account has expired"); + } + + if (!user.isCredentialsNonExpired()) { if (this.context != null) { context.publishEvent(new AuthenticationFailureCredentialsExpiredEvent( authentication, user)); diff --git a/doc/xdocs/changes.xml b/doc/xdocs/changes.xml index 857b84f608..7863dc7634 100644 --- a/doc/xdocs/changes.xml +++ b/doc/xdocs/changes.xml @@ -26,6 +26,7 @@ + Reorder DaoAuthenticationProvider exception logic as per developer list discussion ContextHolder refactored and replaced by SecurityContextHolder Made AclEntry Serializable (correct issue with BasicAclEntryCache) Changed order of credentials verification and expiry checking in DaoAuthenticationProvider. Password must now be successfully verified before expired credentials are reported.