small fixes

smp-server-library/src/main/java/eu/europa/ec/edelivery/smp/conversion/DBUserToUserROConverter.java

@@ -48,7 +48,7 @@ public class DBUserToUserROConverter implements Converter<DBUser, UserRO> {
         target.setLastTokenFailedLoginAttempt(source.getLastTokenFailedLoginAttempt());
         target.setTokenSuspendedUtil(getSuspensionUntilDate(source.getLastTokenFailedLoginAttempt(),
                 source.getSequentialTokenLoginFailureCount(),
-                configurationService.getAccessTokenLoginFailDelayInMilliSeconds(),
+                configurationService.getAccessTokenLoginSuspensionTimeInSeconds(),
                 configurationService.getAccessTokenLoginMaxAttempts()));
 
         target.setActive(source.isActive());

smp-webapp/src/main/java/eu/europa/ec/edelivery/smp/auth/SMPAuthenticationProvider.java

@@ -145,7 +145,7 @@ public class SMPAuthenticationProvider implements AuthenticationProvider {
 
         try {
             Optional<DBUser> oUsr = mUserDao.findUserByCertificateId(userToken, true);
-            if (!oUsr.isPresent()) {
+            if (!oUsr.isPresent() || !oUsr.get().isActive() ) {
                 LOG.securityWarn(SMPMessageCode.SEC_USER_NOT_EXISTS, userToken);
                 //https://www.owasp.org/index.php/Authentication_Cheat_Sheet
                 // Do not reveal the status of an existing account. Not to use UsernameNotFoundException

smp-webapp/src/main/java/eu/europa/ec/edelivery/smp/auth/SMPAuthenticationProviderForUI.java

@@ -91,7 +91,7 @@ public class SMPAuthenticationProviderForUI implements AuthenticationProvider {
         DBUser user;
         try {
             Optional<DBUser> oUsr = mUserDao.findUserByUsername(username);
-            if (!oUsr.isPresent()) {
+            if (!oUsr.isPresent() || !oUsr.get().isActive() ){
                 LOG.debug("User with username does not exists [{}], continue with next authentication provider");
                 LOG.securityWarn(SMPMessageCode.SEC_INVALID_PASSWORD, "Username does not exits", username);
                 delayResponse(startTime);
@@ -107,7 +107,6 @@ public class SMPAuthenticationProviderForUI implements AuthenticationProvider {
             LOG.securityWarn(SMPMessageCode.SEC_USER_NOT_AUTHENTICATED, username, ExceptionUtils.getRootCause(ex), ex);
             delayResponse(startTime);
             throw BAD_CREDENTIALS_EXCEPTION;
-
         }
 
         validateIfUserAccountIsSuspended(user, startTime);