jeecgboot/JeecgBoot · error · AuthenticationException

账号已被锁定,请联系管理员!

Error message

账号已被锁定,请联系管理员!

What it means

Thrown by ShiroRealm.checkUserTokenIsEffect() when loginUser.getStatus() != 1 — the user account exists but is disabled/locked. Status 1 means active; any other value (commonly 2 for locked, 0 for disabled) triggers this exception. This is an intentional security control to prevent locked users from maintaining active sessions.

Source

Thrown at jeecg-boot/jeecg-boot-base-core/src/main/java/org/jeecg/config/shiro/ShiroRealm.java:140

     * @param token
     */
    public LoginUser checkUserTokenIsEffect(String token) throws AuthenticationException {
        // 解密获得username，用于和数据库进行对比
        String username = JwtUtil.getUsername(token);
        if (username == null) {
            throw new AuthenticationException("Token非法无效!");
        }

        // 查询用户信息
        log.debug("———校验token是否有效————checkUserTokenIsEffect——————— "+ token);
        LoginUser loginUser = TokenUtils.getLoginUser(username, commonApi, redisUtil);
        //LoginUser loginUser = commonApi.getUserByName(username);
        if (loginUser == null) {
            throw new AuthenticationException("用户不存在!");
        }
        // 判断用户状态
        if (loginUser.getStatus() != 1) {
            throw new AuthenticationException("账号已被锁定,请联系管理员!");
        }
        // 校验token是否超时失效 & 或者账号密码是否错误
        if (!jwtTokenRefresh(token, username, loginUser.getPassword())) {
            // 用户登录Token过期提示信息
            String userLoginTokenErrorMsg = oConvertUtils.getString(redisUtil.get(CommonConstant.PREFIX_USER_TOKEN_ERROR_MSG + token));
            throw new AuthenticationException(oConvertUtils.isEmpty(userLoginTokenErrorMsg)? CommonConstant.TOKEN_IS_INVALID_MSG: userLoginTokenErrorMsg);
        }
        // 代码逻辑说明: 校验用户的tenant_id和前端传过来的是否一致
        String userTenantIds = loginUser.getRelTenantIds();
        if(MybatisPlusSaasConfig.OPEN_SYSTEM_TENANT_CONTROL && oConvertUtils.isNotEmpty(userTenantIds)){
            String contextTenantId = TenantContext.getTenant();
            log.debug("登录租户：" + contextTenantId);
            log.debug("用户拥有那些租户：" + userTenantIds);
             //登录用户无租户，前端header中租户ID值为 0
            String str ="0";
            if(oConvertUtils.isNotEmpty(contextTenantId) && !str.equals(contextTenantId)){
                // 代码逻辑说明: /issues/I4O14W 用户租户信息变更判断漏洞
                String[] arr = userTenantIds.split(",");

View on GitHub (pinned to 96fb33f5ec)

Solutions

  1. Administrator unlocks the account: set sys_user.status = 1 via the user management UI or SQL.
  2. Clear the user's cached token from Redis (PREFIX_USER_TOKEN + token key) after status change.
  3. Review the failed login attempt policy if accounts are being locked too aggressively.
  4. For the affected user: after unlock, log out and log in again.

Example fix

-- Unlock the user account
UPDATE sys_user SET status = 1 WHERE username = '<username>';
-- Clear stale token cache (find token key pattern in Redis)
-- redis-cli: DEL "PREFIX_USER_TOKEN:<token>"
-- Then user logs out and logs in again.
Defensive patterns

Strategy: try-catch

Validate before calling

// Admin should verify user status before users attempt access
// SELECT username, status FROM sys_user WHERE username = '<username>'
// If status != 1, unlock: UPDATE sys_user SET status = 1 WHERE username = '<username>'

Try / catch

// Handled by JwtFilter — returns 401 with '账号已被锁定'
// Front-end: show lock message and redirect to login
axios.interceptors.response.use(null, error => {
    if (error.response?.data?.message?.includes('锁定')) {
        notification.error({ message: '账号已被锁定，请联系管理员' });
        router.push('/user/login');
    }
});

Prevention

When it happens

Trigger: Admin locks or disables a user account while that user has an active session; user account was auto-locked after too many failed login attempts; batch user status update deactivated the account.

Common situations: Security policy locks accounts after N failed attempts; admin deactivates a departing employee's account; scheduled job bulk-disables accounts; user's status was changed via direct database update without clearing their Redis token cache.

Related errors

AI-assisted analysis of jeecgboot/JeecgBoot@96fb33f5ec (2026-08-14). Data as JSON: /api/errors/2178696b72200838. Report an issue: GitHub.