spring security thymeleaf LockedException custom message

Question

I have a spring boot application secured with spring security. Every thing works fine. but if a user account is locked, how can I display message as Account locked, instead of Invalid user name and password.

My login form

<div class="panel-body">
  <div class="row text-center">
   <div th:if="${param.error}">Invalid user name and password.</div>
   <div th:if="${param.logout}">You have been logged out.</div>
  </div>
  <div class="row">
   <form class="form-horizontal" role="form" th:action="@{/login}"      method="post">
    <div class="form-group">
      <label class="col-md-4 control-label"> User Name </label>
      <div class="col-md-6"><input type="text" name="username" />
      </div>
    </div>
    <div class="form-group"> 
     <label class="col-md-4 control-label"> Password </label>
      <div class="col-md-6"><input type="password" name="password" />
        </div>
    </div>
    <div class="form-group">
      <div class="col-md-offset-4 col-md-6">
        <input type="submit" value="Sign In" class="btn btn-primary" />
      </div>
    </div>
    </form>
 </div>
</div>

Security config

@Configuration
    public static class FormLoginWebSecurityConfigurerAdapter extends WebSecurityConfigurerAdapter {

        @Autowired
        MyAuthenticationSuccessHandler myAuthenticationSuccessHandler;

        @Override
        public void configure(WebSecurity web) throws Exception {
            String[] unsecuredResources = { "/css/**", "/js/**", "/img/**", "/fonts/**" };
            web.ignoring().antMatchers(unsecuredResources);
        }

        @Override
        protected void configure(HttpSecurity http) throws Exception {
            String[] unSecuredUrls = { "login.html", "/login", "/home", "/appPwd.html", "/partials/pwdRequest.html" };
            http.authorizeRequests().antMatchers(unSecuredUrls).permitAll();
            http.authorizeRequests().anyRequest().authenticated().and().formLogin().loginPage("/login").defaultSuccessUrl("/", true)
                    .successHandler(myAuthenticationSuccessHandler)
                    /* .failureHandler(myAuthenticationFailureHandler) */.and().logout().permitAll();
        }
    }

Answer 1

You need to extract the reason for the failure from Spring security. The following code will work.

<div class="error" th:if="${param.error}"
     th:with="errorMsg=${session['SPRING_SECURITY_LAST_EXCEPTION'].message}">
    Reason: <span th:text="${errorMsg}">Wrong input!</span>
</div>