@Override
public Authentication authenticate(Authentication authentication)
        throws AuthenticationException {

    String username = authentication.getName();
    String password = authentication.getCredentials().toString();
    CustomUser user = _userDetailService.loadUserByUsername(username);
    if (user == null || !user.getUsername().equalsIgnoreCase(username)) {
        throw new BadCredentialsException("Username not found.");
    }
    if (!BCrypt.checkpw(password, user.getPassword())) {
        throw new BadCredentialsException("Wrong password.");
    }
    Collection<? extends GrantedAuthority> authorities = user.getAuthorities();
    return new UsernamePasswordAuthenticationToken(user, password, authorities);
}

try {
        Authentication auth = super.authenticate(authentication);
        //if reach here, means login success, else an exception will be thrown
        //reset the user_attempts
        return auth;

    } catch (BadCredentialsException e) {
        //invalid login, update to user_attempts
       throw e;
    }