title: Use custom exceptions in Spring Security
body: <p>I have created a custom <code>AuthenticationProvider</code> to perform custom security checks. I have also created custom exceptions that inherit from <code>AccountStatusException</code> to notify user status problems such as when the user has not verified his account for an specific period of time.My <code>UserDetails</code> is also acustom implementation.</p>
  
  <p>Here is the code for the security checks I perform. Code that is irrelevant to the case has been omitted.</p>
  
  <pre><code>public class SsoAuthenticationProvider implements AuthenticationProvider {
  
      public Authentication authenticate(Authentication authentication) throws AuthenticationException {
          String username = (String) authentication.getPrincipal();
          User user = null;
          if (username != null) {
              user = getUserRepository().findByUserName(username);
              if (user != null) {
                  if (user.getEnabled() != 0) {
                      if ((user.getUserDetail().getConfirmed() != 0)
                              || ((new Date().getTime() - user.getUserDetail().getRequestDate().getTime()) / (1000 * 60 * 60 * 24)) &lt;= getUnconfirmedDays()) {
                          if (getPasswordEncoder().isPasswordValid(user.getPassword(),
                                  (String) authentication.getCredentials(), user)) {
                              user.authenticated = true;
                              user.getAuthorities();
                          }
                      } else {
                          throw new UserNotConfirmedAndTimeExceeded(
                                  "User has not been cofirmed in the established time period");
                      }
                  } else {
                      throw new DisabledException("User is disabled");
                  }
              } else {
                  throw new BadCredentialsException("User or password incorrect");
              }
          } else {
              throw new AuthenticationCredentialsNotFoundException("No credentials found in context");
          }
          return user;
      }
  }
  </code></pre>
  
  <p>The <code>SsoAuthenticationProvider</code> checks:</p>
  
  <ol>
  <li>That the username is registered (exists in the db)</li>
  <li>That the user has confirmed his email</li>
  <li>If the user has not confirmed his email, check that he is still in the grace period (this is a few days we give users to confirm their email while letting them access the site)</li>
  <li>If the user has not confirmed email and he is not in the grace period, throw security exception to signal these status and reject authentication</li>
  </ol>
  
  <p>The problem is that not all of these exceptions are thrown up the stack up to the controller so it seems impossible to inform the user about the login problem.</p>
  
  <p>Using <code>UserDetails</code> methods such as <code>isEnabled()</code> (and similar) is not a possibility as the semantics of our different user account statuses are completely different.</p>
  
  <p>Is this the right approach to build custom security with custom exceptions? Should i implement sth else to make this work?</p>