We\'re using spring security 3.0.5, Java 1.6 and Tomcat 6.0.32. In our .xml config file we\'ve got:
I have found this works for me. Unfortunately, I still not found the exact location of this in SpringSecurity documents:
In any action, you can check the last-used username (no matter what the login was failed or not):
String username = (String) request.getSession().getAttribute("SPRING_SECURITY_LAST_USERNAME");