Spring Security: AuthenticationFailureCredentialsExpiredEvent not fired - spring

Question

I am using spring.security.version = 3.1.0.RELEASE. The problem I am having is that for some reason AuthenticationFailureCredentialsExpiredEvent is not fired.
While debugging the code I found that AbstractUserDetailsAuthenticationProvider do display in the console that "User account credentials have expired". But I am still baffling as to why the event in concern is not triggered.
Here is my code:
class JpaUserDetails implements UserDetails {
...
...
#Override
public boolean isCredentialsNonExpired() {
if (some logic) {
return true;
}
else {
return false;
}
}
}
I do see AbstractUserDetailsAuthenticationProvider displaying in the console "User account credentials have expired" from the following lines of spring code:
public abstract class AbstractUserDetailsAuthenticationProvider implements AuthenticationProvider, InitilizeBean, MessageSourceAware {
...
...
private class DefaultPostAuthenticationChecks implements UserDetailsChecker {
public void check(UserDetails user) {
if(!user.isCredentialsNonExpired()) {
logger.debug("User account credentials have expired");
throw new CredentialsExpiredException(message.getMessage(
"AbstractUserDetailsAuthenticationProvider.credentialsExpired",
"User credentials have expired"), user);
}
}
}
}
The issue is that when the user credentials have expired, I am expecting the Spring to generate the event AuthenticationFailureCredentialsExpiredEvent which I am handling in the following way:
class SecurityEventDispatcher implements ApplicationListener<ApplicationEvent> {
final List<SecurityEventListener> listeners = new ArrayList<SecurityEventListener>();
public void registerListener(SecurityEventListener listener) {
this.listener.add(listener);
}
public void onApplicationEvent(ApplicationEvent event) {
for (SecurityEventListener listener : this.listeners) {
if(listener.canHandle(event)) {
listener.handle(event);
}
}
}
}
This is how I am handling the login failure event:
public class LoginFailedEvent extends SecurityEventListener {
#Override
public boolean canHandle(Object event) {
if(event instanceof AbstractAuthenticationFailureEvent) {
return true;
}
else {
return false;
}
}
#Override
public void handle(Object event) {
if (event instanceof AuthenticationFailureBadCredentialsEvent) {
// do something
}
if (event instanceof AuthenticationFailureCredentialsExpiredEvent) {
// do something
}
}
}
The issue as I mentioned before is that AuthenticationFailureCredentialsExpiredEvent is never fired. I have tested the AuthenticationFailureBadCredentialsEvent which works fine.
This is what I get in event for bad credentials: (which is working fine)
org.springframework.security.authentication.event.AuthenticationFailureBadCredentialsEvent
This is what I get in event for expired password:
ServletRequestHandledEvent: url=[/app/loginFailure] with failureCause = null
Does anyone have any idea what could be wrong? Any help will be highly appreciated.

Answer 1

Here is the answer to this question, since there isn't any much literature out there regarding the issue.
You probably need to set the ProviderManager's
('s) eventPublisher to be something other than
NullEventPublisher. There is not a simple way to do this via the
tag, so you will want to create the
AuthenticationProvider using standard beans configuration and inject
it into a standard Spring Bean for the ProviderManager.
Rob Winch - Spring Security Lead

Answer 2

If anyone is running into this issue, just upgrade the spring security to 3.1.2 or +, the issue is fixed.

Answer 3

(Applies to Spring Security 5)
Spring's default publisher is the NullEventPublisher. This will effectively publish nothing.To get events please configure a
import org.springframework.security.authentication.DefaultAuthenticationEventPublisher;
#Bean
public DefaultAuthenticationEventPublisher defaultAuthenticationEventPublisher() {
return new DefaultAuthenticationEventPublisher();
}
Now the events a published and one can just consume them as any other event:
#EventListener
public void logAuditEvents(AbstractAuthenticationEvent event) {
...
}
and
#EventListener
public void logAuditEvents(AbstractAuthorizationEvent event) {
...
}