Spring Security Account lockout

hi I have a j2ee application using Spring webflow and Spring Security. I 开发者_如何学Pythonwant to implement an account lockout such that after three times of password failure the account wil be locked. How do I implement this.

Can you use an AuthenticationFailureHandler? This approach was suggested in the Acegi FAQ (see Common Problem #3).

That behavior belongs to the underline authentication provider. If you are using LDAP there is a Password Policy, the LdapAuthenticationProvider will throw an exception if the account is blocked.
If your current AuthenticationProvider doesn't have this functionality then subclass it.

You can use AuthenticationFailureHandler

public class MySimpleAuthenticationFailureHandler  implements
AuthenticationFailureHandler {

private RedirectStrategy redirectStrategy = new DefaultRedirectStrategy();

 public MySimpleAuthenticationFailureHandler() {
        super();
    }
public void onAuthenticationFailure(HttpServletRequest request,
        HttpServletResponse response, AuthenticationException exception)
                throws IOException, ServletException {

    String message = "";

    if(exception instanceof UsernameNotFoundException) {
        message = "UsernameNotFoundException";
    } else if(exception instanceof AuthenticationCredentialsNotFoundException) {
        message = "AuthenticationCredentialsNotFoundException";
    }else if(exception instanceof InsufficientAuthenticationException) {
        message = "InsufficientAuthenticationException";
    }else if(exception instanceof AccountExpiredException) {
        message = "AccountExpiredException";
    }else if(exception instanceof CredentialsExpiredException) {
        message = "CredentialsExpiredException";
    }else if(exception instanceof DisabledException) {
        message = "DisabledException";
    }else if(exception instanceof LockedException) {
        message = "LockedException";
    }else if(exception instanceof BadCredentialsException) {
        message = "BadCredentialsException";
    }else{
        message = exception.getMessage();
    }
    final HttpSession session = request.getSession();
    session.setAttribute("errorMessage", message);
    redirectStrategy.sendRedirect(request, response, "/login?error="+message);
}

}