spring security：帐户锁定和未启用有什么区别答案

【问题标题】：spring security: what is the difference between account locked and not enabledspring security：帐户锁定和未启用有什么区别
【发布时间】：2010-12-09 08:12:49
【问题描述】：

UserDetails 界面有两个属性似乎相同，锁定和启用。

这些难道不是彼此相反的吗？

【问题讨论】：

标签： java security spring-security

【解决方案1】：

在 old Acegi blog 上找到这个 - 希望对您有所帮助

Disabled indicates an account has been administratively or automatically disabled for some reason. Usually some action is required to release it.

Locked indicates an account has been automatically suspended due to invalid login attempts. Usually the passage of time or (less often) requesting manual unlocking is required to release it.

The distinction is not used by Acegi Security code aside from providing more informative errors to the user. There is also an order in which different exceptions should be returned, so that a disabled or locked account for instance will not return a bad credentials exception. Refer to the JavaDocs for more details.

【讨论】：

accountExpired也可以这样说吗？