In spring security, how does one display a non-existent user name error (Bad credentials is displayed if the user name does not exist)

 

 

 

By default, no matter whether your user name does not exist or your password is incorrect, the SS will report a bad credentials exception, rather than a specific error. The source code is found in org. springframework. Security. Authentication. Dao. abstractuserdetailsauthenticationprovider.Code.

 

Try {
User = retrieveuser (username, (usernamepasswordauthenticationtoken) Authentication );
} Catch (Usernamenotfoundexception notfound ){
Logger. debug ("user'" + username + "'not found ");

If (Hideusernotfoundexceptions ){
Throw New Badcredentialsexception (messages. getmessage (
"Abstractuserdetailsauthenticationprovider. badcredentials", "Bad credentials "));
} Else {
Throw Notfound;
}
}

 

The default value of hideusernotfoundexceptions in this abstract class is false. Therefore, the error message indicating that the user name does not exist is hidden by default.

Some people on the Internet say that it is too violent to change the source code and then package and compile it. It is easy to modify this attribute by configuring the SS applicationcontext.

For the SS Authentication Manager, you may have configured it as follows:

< Security: Authentication-Manager Alias = "Authenticationmanager" >
< Security: Authentication-provider
User-service-ref = "Customuserdetailsservice"   >
</ Security: Authentication-provider >
</ Security: Authentication-Manager >

 

An Implementation class of the abstract class just now. org. springframework. Security. Authentication. Dao. daoauthenticationprovider is the default class used by authentication-provider. modify this part as follows:

 

< Security: Authentication-Manager Alias = "Authenticationmanager" >
< Security: Authentication-provider
Ref = "Authenticationprovider"   >
</ Security: Authentication-provider >
</ Security: Authentication-Manager >

< Bean ID = "Authenticationprovider" Class = "Org. springframework. Security. Authentication. Dao. daoauthenticationprovider" >
< Property Name = "Userdetailsservice" Ref = "Customuserdetailsservice"   />
< Property Name = "Hideusernotfoundexceptions" Value = "False"   />
</ Bean >

 

Password Policy:

< Authentication-Manager Alias = "Myauthenticationmanager" >
< Authentication-provider Ref = "Authenticationprovider"   >
</ Authentication-provider >
</ Authentication-Manager >

< Beans: Bean ID = "Authenticationprovider"  
Class = "Org. springframework. Security. Authentication. Dao. daoauthenticationprovider" >
< Beans: Property Name = "Userdetailsservice" Ref = "Userdetailservice"   />
<! -- Show user error information -->
< Beans: Property Name = "Hideusernotfoundexceptions" Value = "False"   />
< Beans: Property Name = "Passwordencoder" Ref = "Utpasswordencoder"   />
</ Beans: Bean >