From 734188206d26e7af09a238b4d34eaa01f2e937c0 Mon Sep 17 00:00:00 2001
From: Rob Winch <rwinch@vmware.com>
Date: Mon, 30 Jul 2012 14:09:50 -0500
Subject: [PATCH] SEC-1940: ProviderManager publishes any
 AccountStatusException

Previously there was a bug introduced by SEC-546 that prevented any
AccountStatusException from being published.

Now AccountStatusExceptions are also published.
---
 .../authentication/ProviderManager.java       |  2 +-
 .../authentication/ProviderManagerTests.java  | 20 +++++++++++++++++++
 2 files changed, 21 insertions(+), 1 deletion(-)

diff --git a/core/src/main/java/org/springframework/security/authentication/ProviderManager.java b/core/src/main/java/org/springframework/security/authentication/ProviderManager.java
index 6a2732c1c6..db1d8f7f20 100644
--- a/core/src/main/java/org/springframework/security/authentication/ProviderManager.java
+++ b/core/src/main/java/org/springframework/security/authentication/ProviderManager.java
@@ -197,7 +197,6 @@ public class ProviderManager implements AuthenticationManager, MessageSourceAwar
                         new Object[] {toTest.getName()}, "No AuthenticationProvider found for {0}"));
         }
 
-        eventPublisher.publishAuthenticationFailure(lastException, authentication);
         prepareException(lastException, authentication);
 
         throw lastException;
@@ -205,6 +204,7 @@ public class ProviderManager implements AuthenticationManager, MessageSourceAwar
 
     @SuppressWarnings("deprecation")
     private void prepareException(AuthenticationException ex, Authentication auth) {
+        eventPublisher.publishAuthenticationFailure(ex, auth);
         ex.setAuthentication(auth);
 
         if (clearExtraInformation) {
diff --git a/core/src/test/java/org/springframework/security/authentication/ProviderManagerTests.java b/core/src/test/java/org/springframework/security/authentication/ProviderManagerTests.java
index 8ade4da228..74f6927f3a 100644
--- a/core/src/test/java/org/springframework/security/authentication/ProviderManagerTests.java
+++ b/core/src/test/java/org/springframework/security/authentication/ProviderManagerTests.java
@@ -267,6 +267,26 @@ public class ProviderManagerTests {
         verify(publisher).publishAuthenticationFailure(expected, authReq);
     }
 
+    @Test
+    @SuppressWarnings("deprecation")
+    public void statusExceptionIsPublished() throws Exception {
+        AuthenticationManager parent = mock(AuthenticationManager.class);
+        final LockedException expected = new LockedException("");
+        ProviderManager mgr = new ProviderManager(
+                Arrays.asList(createProviderWhichThrows(expected)), parent);
+        final Authentication authReq = mock(Authentication.class);
+        AuthenticationEventPublisher publisher = mock(AuthenticationEventPublisher.class);
+        mgr.setAuthenticationEventPublisher(publisher);
+        try {
+            mgr.authenticate(authReq);
+            fail("Expected exception");
+        } catch (LockedException e) {
+            assertSame(expected, e);
+            assertSame(authReq, e.getAuthentication());
+        }
+        verify(publisher).publishAuthenticationFailure(expected, authReq);
+    }
+
     private AuthenticationProvider createProviderWhichThrows(final AuthenticationException e) {
         AuthenticationProvider provider = mock(AuthenticationProvider.class);
         when(provider.supports(any(Class.class))).thenReturn(true);