code: @Override
      protected void onUnsuccessfulAuthentication(HttpServletRequest request, HttpServletResponse response, AuthenticationException failed) throws IOException {
          super.onUnsuccessfulAuthentication(request, response, failed);
          LOGGER.log(Level.FINE, "Login attempt failed", failed);
          Authentication auth = failed.getAuthentication();
          if (auth != null) {
              SecurityListener.fireFailedToLogIn(auth.getName());
          }
      }
docs: Leave the information about login failure.
  
  <p>
  Otherwise it seems like Acegi doesn't really leave the detail of the failure anywhere.