How to remove a status message added by the seam security module?

Question

I would like to show a different status message, when a suspended user tries to login. If the user is active we return true from the authenticate method, if not we add a custom StatusMessage message mentioning that the "User X has been suspended". The underlying Identity authentication also fails and adds a StatusMessage. I tried removing the seam generated statusMessage with the following methods, but it doesn't seem to work and shows me 2 different status messages (my custom message, seam generated). What would be the issue here?

StatusMessages statusMessages;

statusMessages.clear()
statusMessages.clearGlobalMessages()
statusMessages.clearKeyedMessages(id)

EDIT1:

public boolean authenticate() {

    log.info("Authenticating {0}", identity.getCredentials().getUsername());

    String username = identity.getCredentials().getUsername();
    String password = identity.getCredentials().getPassword();

    // return true if the authentication was
    // successful, false otherwise
    try {
        Query query = entityManager.createNamedQuery("user.by.login.id");
        query.setParameter("loginId", username);
        // only active users can log in
        query.setParameter("status", "ACTIVE");

        currentUser = (User)query.getSingleResult();
    } catch (PersistenceException ignore) {
        // Provide a status message for the locked account
        statusMessages.clearGlobalMessages();
        statusMessages.addFromResourceBundle(
                "login.account.locked", new Object[] { username });
        return false;
    }

    IdentityManager identityManager = IdentityManager.instance();
    if (!identityManager.authenticate(username, "password")) {
        return false;
    } else {
        log.info("Authenticated user {0} successfully", username);
    }
}

Answer 1

You can see the status messages used by Seam (You must define them in the resource bundle)

• org.jboss.seam.loginFailed
• org.jboss.seam.loginSuccessful
• org.jboss.seam.NotLoggedIn

So you may want to override org.jboss.seam.loginFailed key (Do not forget register your resource bundle)

somePropertiesFile.properties

org.jboss.seam.loginFailed=<YOUR_CUSTOM_MESSAGE_GOES_HERE>

And use the following one

<h:messages globalOnly="true"/>

To show authentication messages

---

UPDATE

If you want a custom message, do as Follows

Starting with Seam 2.1, your should authenticate your user by injecting Credential instead of Identity

@Name("authenticationManager")
public class AuthenticationManager {

    private @In org.jboss.seam.security.Credentials credentials;

    public boolean authenticate() {

        private String username = credentials.getUsername();
        private String password = credentials.getPassword();

        try {

            Query query = entityManager.createNamedQuery("user.by.login.id");
            query.setParameter("loginId", username);
            query.setParameter("status", "ACTIVE");

            currentUser = (User) query.getSingleResult();

        } catch (PersistenceException ignore) {
            return false;
        }

        return true;
    }

}

And inside you JSF Form, use, again, credentials instead of identity

<h:inputText id="username" value="#{credentials.username}"/>
<h:inputText id="password" value="#{credentials.password}"/>

To show your custom message, do as follows

<h:outputText value="#{credentials.username} has been suspended" rendered="#{not identity.loggedIn}"/>

Now i hope it works fine!

Answer 2

I had similar problems (this message thing was one of many trust me!) and I just don't use the seam security module anymore. It's not very flexible/extensible, even all the doc say it is (I think it's a lot of self-back-patting by the part of the developer who wrote it all). A similar example I had a bunch of trouble trying to squeeze into this was the handling of a forced password change during the login process. I tore out a lot of my hair before deciding that the whole seam security module just wasn't up to par. It was a bit of a pain, but I have absolutely no regrets. Good luck!