{"record":{"id":"ae129c2e516b689d","repo":"spring-projects/spring-security","slug":"ex-getstatus-getdefaultmessage","errorCode":null,"errorMessage":"${ex.getStatus().getDefaultMessage()}","messagePattern":"\\$\\{ex\\.getStatus\\(\\)\\.getDefaultMessage\\(\\)\\}","errorType":"exception","errorClass":"LockedException","httpStatus":null,"severity":"warning","filePath":"ldap/src/main/java/org/springframework/security/ldap/authentication/LdapAuthenticationProvider.java","lineNumber":179,"sourceCode":"\t}\n\n\tprotected LdapAuthoritiesPopulator getAuthoritiesPopulator() {\n\t\treturn this.authoritiesPopulator;\n\t}\n\n\tpublic void setHideUserNotFoundExceptions(boolean hideUserNotFoundExceptions) {\n\t\tthis.hideUserNotFoundExceptions = hideUserNotFoundExceptions;\n\t}\n\n\t@Override\n\tprotected DirContextOperations doAuthentication(UsernamePasswordAuthenticationToken authentication) {\n\t\ttry {\n\t\t\treturn getAuthenticator().authenticate(authentication);\n\t\t}\n\t\tcatch (PasswordPolicyException ex) {\n\t\t\t// The only reason a ppolicy exception can occur during a bind is that the\n\t\t\t// account is locked.\n\t\t\tthrow new LockedException(\n\t\t\t\t\tthis.messages.getMessage(ex.getStatus().getErrorCode(), ex.getStatus().getDefaultMessage()));\n\t\t}\n\t\tcatch (UsernameNotFoundException ex) {\n\t\t\tif (this.hideUserNotFoundExceptions) {\n\t\t\t\tthrow new BadCredentialsException(\n\t\t\t\t\t\tthis.messages.getMessage(\"LdapAuthenticationProvider.badCredentials\", \"Bad credentials\"));\n\t\t\t}\n\t\t\tthrow ex;\n\t\t}\n\t\tcatch (NamingException ex) {\n\t\t\tthrow new InternalAuthenticationServiceException(ex.getMessage(), ex);\n\t\t}\n\t}\n\n\t@Override\n\tprotected Collection<? extends GrantedAuthority> loadUserAuthorities(DirContextOperations userData, String username,\n\t\t\tString password) {\n\t\treturn getAuthoritiesPopulator().getGrantedAuthorities(userData, username);","sourceCodeStart":161,"sourceCodeEnd":197,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/ldap/src/main/java/org/springframework/security/ldap/authentication/LdapAuthenticationProvider.java#L161-L197","documentation":"LdapAuthenticationProvider.doAuthentication() converts a PasswordPolicyException from the authenticator into a LockedException whose message is the password-policy status default message (e.g. 'account is locked', resolved via messages.getMessage(ex.getStatus().getErrorCode(), ...)). This indicates the LDAP password policy response reported a problem, most commonly a locked account during a bind.","triggerScenarios":"The configured authenticator (BindAuthenticator with ppolicy control support) throws PasswordPolicyException; doAuthentication maps it to LockedException with ex.getStatus().getDefaultMessage(). Occurs when the directory's password policy control reports the account is locked (too many failed attempts, admin lock, or expired password policies).","commonSituations":"User exceeded the directory's failed-attempt threshold and was auto-locked, administrator manually locked the account, OpenLDAP ppolicy pwdLockout triggered, or repeated automated login attempts from a misbehaving client.","solutions":["Unlock the account in the directory (e.g. reset pwdAccountLockedTime in OpenLDAP or unlock in AD).","Reduce lockout pressure: add rate limiting/account lockout backoff on your login endpoint.","Tell the user their account is locked rather than a generic bad-credentials message.","Review password policy settings (lockout duration/threshold) if lockouts are too aggressive.","Verify ppolicy overlay/control is configured consistently between the app and the directory."],"exampleFix":"// before\ntry {\n    authManager.authenticate(token);\n} catch (LockedException e) {\n    log.error(\"login failed\"); // losing the lock info\n}\n\n// after\ntry {\n    authManager.authenticate(token);\n} catch (LockedException e) {\n    auditLog.record(\"ACCOUNT_LOCKED\", username);\n    throw new ResponseStatusException(HttpStatus.UNAUTHORIZED, \"Your account is locked. Contact support.\");\n}","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n    authManager.authenticate(token);\n} catch (LockedException e) {\n    audit.record(\"ACCOUNT_LOCKED\", token.getName());\n    throw new ResponseStatusException(HttpStatus.LOCKED, \"account is locked; contact your administrator\");\n}","preventionTips":["Add rate limiting/backoff to the login endpoint to avoid triggering pwdLockout.","Surface lockout distinctly to users so they contact support instead of retrying.","Monitor pwdAccountLockedTime events from the directory.","Align app ppolicy controls with directory policy configuration."],"tags":["ldap","account-locked","password-policy","authentication"],"backgroundTag":"authentication-required","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}