浏览代码

Reorder DaoAuthenticationProvider exception logic as per developer list discussion.

Ben Alex 20 年之前
父节点
当前提交
cfb8271826
共有 2 个文件被更改,包括 20 次插入19 次删除
  1. 19 19
      core/src/main/java/org/acegisecurity/providers/dao/DaoAuthenticationProvider.java
  2. 1 0
      doc/xdocs/changes.xml

+ 19 - 19
core/src/main/java/org/acegisecurity/providers/dao/DaoAuthenticationProvider.java

@@ -237,24 +237,6 @@ public class DaoAuthenticationProvider implements AuthenticationProvider,
             }
         }
 
-        if (!user.isEnabled()) {
-            if (this.context != null) {
-                context.publishEvent(new AuthenticationFailureDisabledEvent(
-                        authentication, user));
-            }
-
-            throw new DisabledException("User is disabled");
-        }
-
-        if (!user.isAccountNonExpired()) {
-            if (this.context != null) {
-                context.publishEvent(new AuthenticationFailureAccountExpiredEvent(
-                        authentication, user));
-            }
-
-            throw new AccountExpiredException("User account has expired");
-        }
-
         if (!user.isAccountNonLocked()) {
             if (this.context != null) {
                 context.publishEvent(new AuthenticationFailureAccountLockedEvent(
@@ -281,7 +263,25 @@ public class DaoAuthenticationProvider implements AuthenticationProvider,
             }
         }
 
-        if (!user.isCredentialsNonExpired()) {
+        if (!user.isEnabled()) {
+            if (this.context != null) {
+                context.publishEvent(new AuthenticationFailureDisabledEvent(
+                        authentication, user));
+            }
+
+            throw new DisabledException("User is disabled");
+        }
+
+        if (!user.isAccountNonExpired()) {
+            if (this.context != null) {
+                context.publishEvent(new AuthenticationFailureAccountExpiredEvent(
+                        authentication, user));
+            }
+
+            throw new AccountExpiredException("User account has expired");
+        }
+
+		if (!user.isCredentialsNonExpired()) {
             if (this.context != null) {
                 context.publishEvent(new AuthenticationFailureCredentialsExpiredEvent(
                         authentication, user));

+ 1 - 0
doc/xdocs/changes.xml

@@ -26,6 +26,7 @@
   </properties>
   <body>
     <release version="0.9.0" date="In CVS">
+      <action dev="benalex" type="update">Reorder DaoAuthenticationProvider exception logic as per developer list discussion</action>        
       <action dev="benalex" type="update">ContextHolder refactored and replaced by SecurityContextHolder</action>        
       <action dev="benalex" type="fix">Made AclEntry Serializable (correct issue with BasicAclEntryCache)</action>        
       <action dev="luke_t" type="update">Changed order of credentials verification and expiry checking in DaoAuthenticationProvider. Password must now be successfully verified before expired credentials are reported. </action>