Bug 454558

Description Geoff Waymark 2014-12-09 06:57:45 EST

@Override
    public Details loadUserByUsername(String username) throws UsernameNotFoundException, DataAccessException {
        User u = User.get(username, false);
        Details p = u != null ? u.getProperty(Details.class) : null;
        if (p == null) {
            throw new UsernameNotFoundException("Password is not set: " + username);
        }
        if (p.getUser() == null) {
            throw new AssertionError();
        }
        return p;
    }

    @Override
    protected Details authenticate(String username, String password) throws AuthenticationException {
        Details u = loadUserByUsername(username);
        if (!PASSWORD_ENCODER.isPasswordValid(u.getPassword(), password, null)) {
            throw new BadCredentialsException("Failed to login as " + username);
        }
        return u;
    }

The second method shows that the username exists. We should just return invalid login or incorrect credentials instead.