if ( user.isLocked() && !user.isPasswordChangeRequired() )
{
throw new AccountLockedException( "Account " + source.getPrincipal() + " is locked.", user );
}
PasswordEncoder encoder = securityPolicy.getPasswordEncoder();
getLogger().debug( "PasswordEncoder: " + encoder.getClass().getName() );
boolean isPasswordValid = encoder.isPasswordValid( user.getEncodedPassword(), source.getPassword() );
if ( isPasswordValid )
{
getLogger().debug( "User " + source.getPrincipal() + " provided a valid password" );
try