spring - How to listen login fail / success with oauth2 grant_type=password -

my app uses spring cloud oauth2 rest , angular .

my goal use spring server limit maximum number of login failures

angular2 login code:

const body = "username=" + encodeuri(username) + "&password=" + encodeuri(password) +       "&grant_type=password&client_id=" + encodeuri(this.clientid);  this.http.post("/oauth/token",body,{headers:authheaders}).map{ ... } 

spring auth-server web security code:

    @override       protected void configure(httpsecurity http) throws exception {          http.httpbasic().and().sessionmanagement()               .sessioncreationpolicy(sessioncreationpolicy.stateless)               .and().authorizerequests()             .anyrequest().authenticated();       } 

i try these 2 event :

public class authenticationfailurelistener     implements applicationlistener<authenticationfailurebadcredentialsevent>{ @override   public void onapplicationevent(authenticationfailurebadcredentialsevent e) {   //... } } 

and:

public class authenticationsuccesslistener     implements applicationlistener<authenticationsuccessevent> {   @override   public void onapplicationevent(authenticationsuccessevent e) { //... } } 

but not works

how listen "login fail , success " ?

spring security not publish authenticationfailurebadcredentialsevent (login failed) event default.

you need override defaultauthenticationeventpublisher applicationeventpublisher.

this has done in authentication configuration class below.

@configuration protected static class myauthenticationconfiguration extends         globalauthenticationconfigureradapter {      @value("${ldap.url}")     string url;      @value("${ldap.base}")     string base;      @value("${ldap.managerdn}")     string managerdn;      @value("${ldap.password}")     string password;      @autowired     applicationeventpublisher applicationeventpublisher;       @override     public void init(authenticationmanagerbuilder auth) throws exception {         auth.ldapauthentication().usersearchfilter("samaccountname={0}")                 .usersearchbase(base).contextsource().url(url)                 .managerdn(managerdn).managerpassword(password);         //this publisher trigger authenticationfailurebadcredentialsevent (abstractauthenticationfailureevent)         auth.authenticationeventpublisher(new defaultauthenticationeventpublisher(applicationeventpublisher));      } 

to support form based authentication, add below configure() method.

.and().formlogin(); 

entire configure method should similar below.

@override protected void configure(httpsecurity http) throws exception {  http.authorizerequests().antmatchers("/css/**").permitall()         .anyrequest().fullyauthenticated().and().formlogin(); super.configure(http);  }