Spring安全百里香已锁定异常自定义消息

Question

我有一个Spring Security保护的Spring Boot应用程序。一切都很好。但如果用户帐户被锁定，我如何将消息显示为account locked，而不是Invalid user name and password。

我的登录表单

<div class="panel-body">
  <div class="row text-center">
   <div th:if="${param.error}">Invalid user name and password.</div>
   <div th:if="${param.logout}">You have been logged out.</div>
  </div>
  <div class="row">
   <form class="form-horizontal" role="form" th:action="@{/login}"      method="post">
    <div class="form-group">
      <label class="col-md-4 control-label"> User Name </label>
      <div class="col-md-6"><input type="text" name="username" />
      </div>
    </div>
    <div class="form-group"> 
     <label class="col-md-4 control-label"> Password </label>
      <div class="col-md-6"><input type="password" name="password" />
        </div>
    </div>
    <div class="form-group">
      <div class="col-md-offset-4 col-md-6">
        <input type="submit" value="Sign In" class="btn btn-primary" />
      </div>
    </div>
    </form>
 </div>
</div>

安全配置

@Configuration
    public static class FormLoginWebSecurityConfigurerAdapter extends WebSecurityConfigurerAdapter {

        @Autowired
        MyAuthenticationSuccessHandler myAuthenticationSuccessHandler;

        @Override
        public void configure(WebSecurity web) throws Exception {
            String[] unsecuredResources = { "/css/**", "/js/**", "/img/**", "/fonts/**" };
            web.ignoring().antMatchers(unsecuredResources);
        }

        @Override
        protected void configure(HttpSecurity http) throws Exception {
            String[] unSecuredUrls = { "login.html", "/login", "/home", "/appPwd.html", "/partials/pwdRequest.html" };
            http.authorizeRequests().antMatchers(unSecuredUrls).permitAll();
            http.authorizeRequests().anyRequest().authenticated().and().formLogin().loginPage("/login").defaultSuccessUrl("/", true)
                    .successHandler(myAuthenticationSuccessHandler)
                    /* .failureHandler(myAuthenticationFailureHandler) */.and().logout().permitAll();
        }
    }

Answer 1

您需要从 Spring 安全性中提取失败的原因。以下代码将起作用。

<div class="error" th:if="${param.error}"
     th:with="errorMsg=${session['SPRING_SECURITY_LAST_EXCEPTION'].message}">
    Reason: <span th:text="${errorMsg}">Wrong input!</span>
</div>