Data access in Validator?

Any opinions on the best place to locate complex validation and/or validation that requires database access, for example validating a username and password?

I see two options, and I could obviously be missing several:

1.) A LoginCommand object backing the login form is associated with a LoginCommandValidator object which checks to see whether or not a username and password were supplied AND makes the call (I'm sure through some persistence object) to the database to verify the username and password

or

2.) The LoginCommandValidator from above simply verifies that a username and password were supplied. Validation of the username and password against the database occur in the LoginController's onBindAndValidator method (is this the right place to put it in this scenario?).

Kind of along these lines, how robust should these Validator objects be? For example, if I have an OrderValidator there may be (relatively) extremely complex business logic and/or database access/lookups involved in validating an order. Is the OrderValidator the place for this?

Any strong thoughts one way or the other? Thanks in advance.

Brian

I don't put anything other than basic sanity checking in a validator. Anything that would classify as business logic goes in a class that's called by the method that processes the form (like onSubmit) in the controller.