Profile with spring-security doesn´t work

Question

I´m using spring-security to validate at users in function its profiles, but my app doesn´t make it well, when I see the file log, it show me this:

DEBUG DaoAuthenticationProvider:308 - User account is locked

In my form login I put the data well, but I never pass to other page, I´m always in the same page (form page), I introduce good or bad data

My code is:

file configuration spring-security.xml

<beans:beans xmlns:security="http://www.springframework.org/schema/security"
    xmlns:beans="http://www.springframework.org/schema/beans" 
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.1.xsd
                        http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.1.xsd">

    <security:http auto-config="true" access-decision-manager-ref="accessDecisionManager">
        <security:intercept-url pattern="/" access="IS_AUTHENTICATED_ANONYMOUSLY" />

        <security:intercept-url pattern="/init" access="PROFILE_ADMINISTRATOR" />

        <security:form-login 
            login-page="/" 
            default-target-url="/init" 
            always-use-default-target='true'
            authentication-failure-url="/"/>

        <security:http-basic />

    </security:http>  

    <security:authentication-manager alias="autenticationManagerUserService">
        <security:authentication-provider user-service-ref="userService">
            <security:password-encoder hash="md5"/>
        </security:authentication-provider>
     </security:authentication-manager> 

     <beans:bean id="accessDecisionManager" class="org.springframework.security.access.vote.AffirmativeBased">

        <beans:property name="decisionVoters">
            <beans:list>
                <beans:ref bean="decisorDeRoles"/>
                <beans:ref bean="decisorDeAutenticacion"/>
            </beans:list>
        </beans:property>
    </beans:bean>

    <beans:bean id="decisorDeRoles" class="org.springframework.security.access.vote.RoleVoter">
        <beans:property name="rolePrefix" value="PROFILE_"/>
    </beans:bean>

    <beans:bean id="decisorDeAutenticacion" class="org.springframework.security.access.vote.AuthenticatedVoter"/>

    <beans:bean id="loggerListener" class="org.springframework.security.authentication.event.LoggerListener"/>

</beans:beans>

class of UserDatailsService

@Service("userService")
public class SecurityAuthenticationProvider implements UserDetailsService
{
UserDao userDao = new UserDao ();

    @Override
    public UserDetails loadUserByUsername (String username) throws  UsernameNotFoundException, DataAccessException
    {
        User user = null;
        List<User> users = userDao.getUser (username);
        if (users.size () == 0)
        {
            throw new UsernameNotFoundException ("");
        }
        else
        {
            user = users.get (0);
            user.setAuthorities (userDao.getProfileUser (username));
            return user;
        }
    }
}

class UserDatails

public class User implements UserDetails
{    
    private List<GrantedAuthority> profiles;

    private String username;
    private String password;
    private boolean accountNonExpired;
    private boolean accountNonLocked;
    private boolean credentialsNonExpired;
    private boolean enabled;

    @Override
    public Collection<? extends GrantedAuthority> getAuthorities ()
    {
        return profiles;
    }

    @SuppressWarnings("unchecked")
    public void setAuthorities (List<? extends GrantedAuthority> profiles)
    {
        this.profiles = (List<GrantedAuthority>) profiles;
    }

    @Override
    public String getPassword ()
    {
        return password;
    }

    @Override
    public String getUsername ()
    {
        return username;
    }

    @Override
    public boolean isAccountNonExpired ()
    {
        return accountNonExpired;
    }

    @Override
    public boolean isAccountNonLocked ()
    {
        return accountNonLocked;
    }

    @Override
    public boolean isCredentialsNonExpired ()
    {
        return credentialsNonExpired;
    }

    @Override
    public boolean isEnabled ()
    {
        return enabled;
    }

    public void setUsername (String username)
    {
        this.username = username;
    }

    public void setPassword (String password)
    {
        this.password = password;
    }

    public void setAccountNonExpired (boolean accountNonExpired)
    {
        this.accountNonExpired = accountNonExpired;
    }

    public void setAccountNonLocked (boolean accountNonLocked)
    {
        this.accountNonLocked = accountNonLocked;
    }

    public void setCredentialsNonExpired (boolean credentialsNonExpired)
    {
        this.credentialsNonExpired = credentialsNonExpired;
    }

    public void setEnabled (boolean enabled)
    {
        this.enabled = enabled;
    }

}

class GrantedAuthority

public class Profile implements GrantedAuthority
{
    private String profile;

    @Override
    public String getAuthority ()
    {
        return profile;
    }

    public String getProfile ()
    {
        return profile;
    }

    public void setProfile (String profile)
    {
        this.profile = profile;
    }

}

Class that I have created to simulate access to database (to obtain data)

public class UserDao
{

    public List<? extends GrantedAuthority> getProfileUser (String name)
    {
        List<GrantedAuthority> listGrantedAuthorities = new ArrayList<GrantedAuthority> ();
        Profile profile = new Profile ();
        profile.setProfile ("PROFILE_ADMINISTRATOR");
        listGrantedAuthorities.add (profile);
        return listGrantedAuthorities;
    }

    public List<User> getUser (String name)
    {
        List<User> listUser = new ArrayList<User> ();
        User user = new User ();
        user.setUsername ("Admin");
        user.setPassword ("1234");
        // user.setAccountNonExpired (true);
        // user.setAccountNonLocked (true);
        // user.setCredentialsNonExpired (true);
        // user.setEnabled (true);
        listUser.add (user);

        return listUser;
    }

}

Thanks.

Answer 1

I faced the same issue while working with rest oauth2 spring security.

SOLUTION

you need to make few changes in your class which implements UserDetails (org.springframework.security.core.userdetails), in your case its the user class.

For the following overriding methods isAccountNonLocked(), isAccountNonExpired(), isEnabled(), isCredentialsNonExpired() change the retrun type to true (by default its false).

make note that these all methods should have a logic to return true or false depending on your requirement but to make your code work i am suggesting you to return true for all the mentioned methods.