trying to understand new AuthenticationException.extraInformation deprecation

[eitan.suez]

hello,

i noticed in the changelogs a recent issue sec-1742 (which i cannot access anonymously in jira) that AuthenticationException.extraInformation is deprecated.

i currently have a setup where i override onAuthenticationFailure() in my custom AuthenticationFailureHandler to keep track of failed authentication count. i use the badcredentialsexception.getExtraInformation() to access the user details object. my implementation of my userdetails object has a field that keeps track of the count of bad authentication attempts.

so here's my question: given that extrainformation is now deprecated and presumably going away, how do i obtain a reference to my userdetails object from inside the onAuthenticationFailure() method:?

    public void onAuthenticationFailure(HttpServletRequest request, HttpServletResponse response,
            AuthenticationException exception) throws IOException, ServletException

thanks,
/ eitan

[mpr]

I'am just upgrading our webapp to spring-security-3.1.0.RELEASE and I also noticed the deprecation of AuthenticationException.extraInformation. I have exactly the same use case as Eitan and I'am also wondering how this use case can be implemented now.

Even as authenticated user I cannot access the referenced sec-1742 in jira.springsource.org because I get a Permission Violation.

thanks
Martin

[jonnybecker]

Same use case here and no sulution yet.

Anybody got a solution on this topic?

Thanks
Jonny

[zakhrim]

One more

Thanks,
Stefano

[SigmundL]

+1 more..

Sigmund Lundgren