intermediateManaging Users: UserDetailsService & UserDetailsManager

What happens if isEnabled() returns false for a user during login?

DaoAuthenticationProvider checks account status flags (enabled, non-locked, non-expired, credentials-non-expired) BEFORE comparing passwords. If isEnabled() is false, a DisabledException is thrown immediately, regardless of whether the submitted password is correct — this prevents a disabled account from being usable even if its old password is somehow still known.

Ready to master this question?

Generate a complete walkthrough — background, the full answer in plain language, a working code example explained line by line, a real-world scenario, common mistakes, and how this same question gets asked in different ways.

Next Step

Continue to Why must you always call passwordEncoder.encode() during user registration? →← Back to all Spring Security questions