title: Spring Security : LockedException is thrown instead of BadCredentialsException, why?
body: <blockquote>
    <p>Using Spring Security 4.0.2.RELEASE</p>
  </blockquote>
  
  <p>For basic user authentication using spring-security framework, I implemented spring-security <code>DaoAuthenticationProvider</code></p>
  
  <p>When user tries to login with correct username, <strong>incorrect</strong> password and user's <strong>account is already locked</strong>, then i expected that spring-security authentication module would be throwing <code>BadCredentialsException</code> But instead it throws <code>LockedException</code></p>
  
  <p>My Questions are</p>
  
  <ol>
  <li>why spring-security is processing the user for further authentication while the credentials specially password is incorrect ?</li>
  <li>Is it good practice to show message in application that "User is Locked" even if the password for the user is invalid ?</li>
  <li>How do i manage to generate/catch <code>BadCredentialsException</code> for invalid password and locked user ?</li>
  </ol>
  
  <p>Any help would be appreciated. Authentication Provider implementation code is </p>
  
  <pre><code>@Component("authenticationProvider")
  public class LoginAuthenticationProvider extends DaoAuthenticationProvider {
  
      @Autowired
      UserDAO userDAO;
  
      @Autowired
      @Qualifier("userDetailsService")
      @Override
      public void setUserDetailsService(UserDetailsService userDetailsService) {
          super.setUserDetailsService(userDetailsService);
      }
  
      @Override
      public Authentication authenticate(Authentication authentication) throws AuthenticationException {
          try {
              Authentication auth = super.authenticate(authentication);
              // if reach here, means login success, else exception will be thrown
  
              // reset the user attempts
              userDAO.resetPasswordRetryAttempts(authentication.getName());
  
              return auth;
          } catch (BadCredentialsException ex) {
              // invalid login, update user attempts
              userDAO.updatePasswordRetryAttempts(authentication.getName(), PropertyUtils.getLoginAttemptsLimit());
              throw ex;
          } catch (LockedException ex) {
              // this user is locked
              throw ex;
          } catch (AccountExpiredException ex) {
              // this user is expired
              throw ex;
          } catch (Exception ex) {
              ex.printStackTrace();
              throw ex;
          }
      }
  
  }
  </code></pre>