title: java spring security, if login user is disabled, how to know password is wrong or not
body: <pre><code>**Login** in *spring security*, when user is disabled, i can't know the password is wrong or not.
  please,tell me how.
  [AbstractUserDetailsAuthenticationProvider][1]
  </code></pre>
  
  <p>in spring security:</p>
  
  <pre><code>AbstractUserDetailsAuthenticationProvider.authenticate(){
   // (1) check disabled, if disabled, ***throw exception***
   preAuthenticationChecks.check(user);
   // (2)check password
   additionalAuthenticationChecks(user, (UsernamePasswordAuthenticationToken) authentication);
  </code></pre>
  
  <h2>Heading</h2>
  
  <pre><code>(1)`public void check(UserDetails user) {
          if (!user.isAccountNonLocked()) {
              logger.debug("User account is locked");
  
              throw new LockedException(messages.getMessage("AbstractUserDetailsAuthenticationProvider.locked",
                      "User account is locked"), user);
          }
  
          if (!user.isEnabled()) {
              logger.debug("User account is disabled");
  
              throw new DisabledException(messages.getMessage("AbstractUserDetailsAuthenticationProvider.disabled",
                      "User is disabled"), user);
          }
  
          if (!user.isAccountNonExpired()) {
              logger.debug("User account is expired");
  
              throw new AccountExpiredException(messages.getMessage("AbstractUserDetailsAuthenticationProvider.expired",
                      "User account has expired"), user);
          }
      }`
  </code></pre>
  
  <p>(2)`protected void additionalAuthenticationChecks(UserDetails userDetails,
              UsernamePasswordAuthenticationToken authentication) throws AuthenticationException {
          Object salt = null;</p>
  
  <pre><code>    if (this.saltSource != null) {
          salt = this.saltSource.getSalt(userDetails);
      }
  
      if (authentication.getCredentials() == null) {
          logger.debug("Authentication failed: no credentials provided");
  
          throw new BadCredentialsException(messages.getMessage(
                  "AbstractUserDetailsAuthenticationProvider.badCredentials", "Bad credentials"), userDetails);
      }
  
      String presentedPassword = authentication.getCredentials().toString();
  
      if (!passwordEncoder.isPasswordValid(userDetails.getPassword(), presentedPassword, salt)) {
          logger.debug("Authentication failed: password does not match stored value");
  
          throw new BadCredentialsException(messages.getMessage(
                  "AbstractUserDetailsAuthenticationProvider.badCredentials", "Bad credentials"), userDetails);
      }
  }`
  </code></pre>
  
  <p>}</p>
  
  <p>}</p>