What happens if isEnabled() returns false for a user during login?

DaoAuthenticationProvider checks account status flags (enabled, non-locked, non-expired, credentials-non-expired) BEFORE comparing passwords. If isEnabled() is false, a DisabledException is thrown immediately, regardless of whether the submitted password is correct — this prevents a disabled account from being usable even if its old password is somehow still known.