Checking disabled user's credentials, Spring Security, UserDetailsService

174 Views Asked by At

I'm using Spring Security 5.4.2 to authenticate users using UserDetailsService implementation. Users that have not verified their email account are disabled (my UserDetails implementation's isEnabled() method returns false). When a disabled user tries to login I get a DisabledException, even if the password used to log in is incorrect. I would like to hide the fact that an account is disabled from users that don't know the password and inform only the ones that provide good credentials that their account is disabled. Is there a way to check the credentials before checking isEnabled?

0

There are 0 best solutions below