{"record":{"id":"c9680a9a193f1c52","repo":"spring-projects/spring-security","slug":"user-is-disabled","errorCode":null,"errorMessage":"User is disabled","messagePattern":"User is disabled","errorType":"exception","errorClass":"DisabledException","httpStatus":null,"severity":"error","filePath":"core/src/main/java/org/springframework/security/authentication/dao/AbstractUserDetailsAuthenticationProvider.java","lineNumber":379,"sourceCode":"\n\tpublic void setAuthoritiesMapper(GrantedAuthoritiesMapper authoritiesMapper) {\n\t\tthis.authoritiesMapper = authoritiesMapper;\n\t}\n\n\tprivate class DefaultPreAuthenticationChecks implements UserDetailsChecker {\n\n\t\t@Override\n\t\tpublic void check(UserDetails user) {\n\t\t\tif (!user.isAccountNonLocked()) {\n\t\t\t\tAbstractUserDetailsAuthenticationProvider.this.logger\n\t\t\t\t\t.debug(\"Failed to authenticate since user account is locked\");\n\t\t\t\tthrow new LockedException(AbstractUserDetailsAuthenticationProvider.this.messages\n\t\t\t\t\t.getMessage(\"AbstractUserDetailsAuthenticationProvider.locked\", \"User account is locked\"));\n\t\t\t}\n\t\t\tif (!user.isEnabled()) {\n\t\t\t\tAbstractUserDetailsAuthenticationProvider.this.logger\n\t\t\t\t\t.debug(\"Failed to authenticate since user account is disabled\");\n\t\t\t\tthrow new DisabledException(AbstractUserDetailsAuthenticationProvider.this.messages\n\t\t\t\t\t.getMessage(\"AbstractUserDetailsAuthenticationProvider.disabled\", \"User is disabled\"));\n\t\t\t}\n\t\t\tif (!user.isAccountNonExpired()) {\n\t\t\t\tAbstractUserDetailsAuthenticationProvider.this.logger\n\t\t\t\t\t.debug(\"Failed to authenticate since user account has expired\");\n\t\t\t\tthrow new AccountExpiredException(AbstractUserDetailsAuthenticationProvider.this.messages\n\t\t\t\t\t.getMessage(\"AbstractUserDetailsAuthenticationProvider.expired\", \"User account has expired\"));\n\t\t\t}\n\t\t}\n\n\t}\n\n\tprivate class DefaultPostAuthenticationChecks implements UserDetailsChecker {\n\n\t\t@Override\n\t\tpublic void check(UserDetails user) {\n\t\t\tif (!user.isCredentialsNonExpired()) {\n\t\t\t\tAbstractUserDetailsAuthenticationProvider.this.logger","sourceCodeStart":361,"sourceCodeEnd":397,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/core/src/main/java/org/springframework/security/authentication/dao/AbstractUserDetailsAuthenticationProvider.java#L361-L397","documentation":"DefaultPreAuthenticationChecks.check() in AbstractUserDetailsAuthenticationProvider throws DisabledException 'User is disabled' when UserDetails.isEnabled() returns false. The username/password matched but the account is not enabled for login.","triggerScenarios":"DaoAuthenticationProvider pre-authentication check on a UserDetails with isEnabled() == false.","commonSituations":"Unactivated registrations; admin-disabled users; UserDetailsService mapping the enabled column incorrectly; custom UserDetails with enabled hardcoded false.","solutions":["Enable the account in the user store or fix isEnabled() in your UserDetails implementation","Implement the account-activation step (email confirmation) that flips enabled to true","Fix UserDetailsService mapping if the enabled flag is misread","Handle DisabledException in an AuthenticationFailureHandler to guide users to activation"],"exampleFix":"// before\nreturn new User(username, password, true, true, true, false, authorities); // enabled=false in 4th-true/false group? ensure correct position\n// after\nreturn User.withUsername(username).password(password).disabled(false).accountLocked(false).authorities(authorities).build();","handlingStrategy":"try-catch","validationCode":"UserDetails user = uds.loadUserByUsername(username);\nif (!user.isEnabled()) { throw new IllegalStateException(\"Account not enabled: \" + username); }","typeGuard":"boolean isLoginAllowed(UserDetails u) { return u.isEnabled(); }","tryCatchPattern":"try { authMgr.authenticate(token); } catch (DisabledException e) { return ResponseEntity.status(403).body(\"Account is disabled.\"); }","preventionTips":["Verify UserDetailsService correctly maps the enabled column","Complete the registration-activation flow before allowing login","Write tests asserting enabled/disabled behavior of custom UserDetails"],"tags":["spring-security","authentication","account-disabled"],"backgroundTag":"authentication-required","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}