春季安全帳戶鎖定

Question

您好我有一個使用Spring Webflow和Spring Security的j2ee應用程序。我想執行一個帳戶鎖定，以便在三次密碼失敗後，帳戶將被鎖定。我如何實現這一點。

Answer 1

你能用AuthenticationFailureHandler嗎？這種方法在Acegi FAQ中提出（見常見問題＃3）。

Answer 2

該行爲屬於下劃線身份驗證提供程序。如果您使用的LDAP有密碼策略，則LdapAuthenticationProvider將在帳戶被阻止時引發異常。
如果您當前的AuthenticationProvider沒有此功能，那麼對它進行子類化。

Answer 3

您可以使用AuthenticationFailureHandler

public class MySimpleAuthenticationFailureHandler implements 
AuthenticationFailureHandler { 

private RedirectStrategy redirectStrategy = new DefaultRedirectStrategy(); 

public MySimpleAuthenticationFailureHandler() { 
     super(); 
    } 
public void onAuthenticationFailure(HttpServletRequest request, 
     HttpServletResponse response, AuthenticationException exception) 
       throws IOException, ServletException { 

    String message = ""; 

    if(exception instanceof UsernameNotFoundException) { 
     message = "UsernameNotFoundException"; 
    } else if(exception instanceof AuthenticationCredentialsNotFoundException) { 
     message = "AuthenticationCredentialsNotFoundException"; 
    }else if(exception instanceof InsufficientAuthenticationException) { 
     message = "InsufficientAuthenticationException"; 
    }else if(exception instanceof AccountExpiredException) { 
     message = "AccountExpiredException"; 
    }else if(exception instanceof CredentialsExpiredException) { 
     message = "CredentialsExpiredException"; 
    }else if(exception instanceof DisabledException) { 
     message = "DisabledException"; 
    }else if(exception instanceof LockedException) { 
     message = "LockedException"; 
    }else if(exception instanceof BadCredentialsException) { 
     message = "BadCredentialsException"; 
    }else{ 
     message = exception.getMessage(); 
    } 
    final HttpSession session = request.getSession(); 
    session.setAttribute("errorMessage", message); 
    redirectStrategy.sendRedirect(request, response, "/login?error="+message); 
} 

}