Custom Error Messages in Login JSP

[kbaum]

I am using the AuthenticationProcessingFilter for logins to my web application. From a security standpoint everything works nicely, but I am having some trouble customizing the error messages on failed login attempts. The requirements are such that I display error messages indicated the reason for the login failure. These messages include:

"You have entered an invalid password. "

and

"User name not found. "

The issue is that upon failure, I do not have the necessary information to figure out the reason for the login failure. In both of the cases above, I am forwarded back to a jsp with access to a BadCredentialsException containing a "Bad credentials presented" error message. Am I missing something? Thanks.

-karl

[Ben Alex]

You need to set the DaoAuthenticationProvider.hideUserNotFoundExceptio ns to false (it defaults to true, which is why you get the same exception for both authentication failure reasons).

[kbaum]

That worked perfectly. Thanks for the unbelievably quick response.

-karl