title: Handling failed login notifications with Spring Security 3 login handlers
body: <p>In my application, I would like to increase a failed login attempt counter for my users and lock them when it reaches a certain attemp count using Spring Security version 3.1.4.RELEASE.</p>
  
  <p>I have succcessfully implemented a simple login success notification handler that resets the counter to zero and saves this state in my database like so.</p>
  
  <pre><code>public class BitfoodLoginSuccessHandler extends BitfoodAuthHandler implements AuthenticationSuccessHandler {
  
    @Override
    public void onAuthenticationSuccess(HttpServletRequest arg0,
        HttpServletResponse arg1, Authentication arg2) throws IOException,
        ServletException {
  
      String userName = arg2.getName();
      AppUser result = getBitfoodDao().getAuthDao().getUser(userName);
  
      if (result.getLoginStatus().getStatus() == UserLoginStatus.STATUS_ACTIVE) {
        result.getLoginStatus().setLoginFailCount(0);
        getBitfoodDao().getAuthDao().save(result);
      } // TODO redirect on success.
    }
  }
  </code></pre>
  
  <p>However, I'm trying to figure out how to implement the opposite case in a failure event handler which is specifically, an implementation of <code>org.springframework.security.web.authentication.AuthenticationFailureHandler</code>.</p>
  
  <pre><code>public class BitfoodLoginFailedHandler extends BitfoodAuthHandler implements
      AuthenticationFailureHandler {
  
    @Override
    public void onAuthenticationFailure(HttpServletRequest arg0,
        HttpServletResponse arg1, AuthenticationException arg2)
        throws IOException, ServletException {
      log.info("???????");
      /*if (ls.getLoginFailCount() &gt;= 3) { // TODO parameterize this value
        ls.setStatus(UserLoginStatus.STATUS_LOCKED);
      }*/
    }
  }
  </code></pre>
  
  <p>I know that <code>org.springframework.security.core.AuthenticationException</code> offfers these two methods which could potentially provide the login information I need. Specifically, I'm trying to find out which username (if any and if it is indeed a user I have on DB) has failed the current login attempt.</p>
  
  <p><a href="http://static.springsource.org/spring-security/site/docs/3.1.x/apidocs/org/springframework/security/core/AuthenticationException.html" rel="nofollow">org.springframework.security.core.AuthenticationException</a></p>
  
  <pre><code>AuthenticationException::getAuthentication()
  AuthenticationException::getExtraInformation() 
  </code></pre>
  
  <p>However, both methodds are mark as deprecated in versions 3.1.x of the API. So:</p>
  
  <p>1) Is there another way I could retrieve the failed login username of the attempt using these notification handlers?</p>
  
  <p>2) Should I consider using another mechanism altogether to perform this logic? If so, which alternatives does Spring Security 3 offer?</p>
  
  <p><strong>UPDATE:</strong> Wow, @axtavt 's answer worked and ended being up more clean than what I had in mind since I no longer have to mess with my security manager's filter configuration anymore. Nice!</p>
  
  <p>Updated code:</p>
  
  <p>I changed the interfaces of my custom classes:</p>
  
  <pre><code>public class BitfoodLoginFailedHandler extends BitfoodAuthHandler 
      implements ApplicationListener&lt;AuthenticationFailureBadCredentialsEvent&gt; 
  
  public class BitfoodLoginSuccessHandler extends BitfoodAuthHandler 
      implements ApplicationListener&lt;AuthenticationSuccessEvent&gt;
  </code></pre>
  
  <p>I implemented the appropriate method:</p>
  
  <pre><code>public void onApplicationEvent(AuthenticationSuccessEvent event)
  public void onApplicationEvent(AuthenticationFailureBadCredentialsEvent event)
  </code></pre>
  
  <p>Left their bean context definitions as-is:</p>
  
  <pre><code>&lt;beans:bean id="successHandler" class="org.bitfood.admin.auth.BitfoodLoginSuccessHandler"&gt;
      &lt;beans:property name="bitfoodDao" ref="daoService"/&gt;
  &lt;/beans:bean&gt;
  
  &lt;beans:bean id="failureHandler" class="org.bitfood.admin.auth.BitfoodLoginFailedHandler"&gt;
      &lt;beans:property name="bitfoodDao" ref="daoService"/&gt;
  &lt;/beans:bean&gt;
  </code></pre>
  
  <p>And Voila! Received appropriate notifications (including username data) before the request ended.</p>
  
  <p>Thanks!</p>