shuzheng/zheng · warning · LockedAccountException

LockedAccountException

Error message

LockedAccountException

What it means

UpmsRealm throws Shiro's LockedAccountException when the authenticated user exists and the password matches but upmsUser.getLocked() == 1, meaning the account has been administratively disabled. Authentication is denied even with correct credentials.

Source

Thrown at zheng-upms/zheng-upms-client/src/main/java/com/zheng/upms/client/shiro/realm/UpmsRealm.java:94

        String username = (String) authenticationToken.getPrincipal();
        String password = new String((char[]) authenticationToken.getCredentials());
        // client无密认证
        String upmsType = PropertiesFileUtil.getInstance("zheng-upms-client").get("zheng.upms.type");
        if ("client".equals(upmsType)) {
            return new SimpleAuthenticationInfo(username, password, getName());
        }

        // 查询用户信息
        UpmsUser upmsUser = upmsApiService.selectUpmsUserByUsername(username);

        if (null == upmsUser) {
            throw new UnknownAccountException();
        }
        if (!upmsUser.getPassword().equals(MD5Util.md5(password + upmsUser.getSalt()))) {
            throw new IncorrectCredentialsException();
        }
        if (upmsUser.getLocked() == 1) {
            throw new LockedAccountException();
        }

        return new SimpleAuthenticationInfo(username, password, getName());
    }

}

View on GitHub (pinned to 7005c0a775)

Solutions

1. Set locked = 0 for the user in the upms_user table (or via the admin UI) if the lock is no longer warranted.
2. Inform the user to contact an administrator to unlock the account.
3. Catch LockedAccountException in the login controller and show an 'account is locked' message distinct from wrong password.
4. Review why the account was locked (failed attempts, admin action) before unlocking.

Example fix

// before
currentUser.login(token); // throws LockedAccountException
// after
try {
    currentUser.login(token);
} catch (LockedAccountException lae) {
    model.addAttribute("error", "账号已被锁定，请联系管理员");
    return "login";
}

UpmsUser u = upmsApiService.selectUpmsUserByUsername(username);
if (u != null && u.getLocked() == 1) {
    // short-circuit: inform user the account is locked
}

boolean isLocked(UpmsUser u) {
    return u != null && u.getLocked() != null && u.getLocked() == 1;
}

try {
    currentUser.login(token);
} catch (LockedAccountException e) {
    model.addAttribute("error", "账号已被锁定，请联系管理员");
    return "login";
}

When it happens

Trigger: Subject.login for a user whose upms_user.locked column is 1 — typically after an admin locked the account or too many failed attempts set the flag.

Common situations: Admin disabled a user in the UPMS management console; account locked by security policy; test account left locked; environment DB copy contains locked users.

Related errors

• UnknownAccountException
• IncorrectCredentialsException

AI-assisted analysis of shuzheng/zheng@7005c0a775 (2026-09-04). Data as JSON: /api/errors/8777fd707ca69d99. Report an issue: GitHub.