Check user data before login

I have http auth.

public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

....

@Override
	protected void configure(HttpSecurity http) throws Exception {
		http.cors().and().csrf().disable()
			.exceptionHandling().authenticationEntryPoint(unauthorizedHandler).and()
			.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS).and()
			.authorizeRequests()
            .antMatchers("/api/auth/**").permitAll()
			.anyRequest().authenticated();

		http.addFilterBefore(authenticationJwtTokenFilter(), UsernamePasswordAuthenticationFilter.class);
	}
....
}

So, I have some data in a database about a user (userStatus), who trying to auth. I want to check it before auth, and throw an exception if user status is something like "REFUSED".

Of course userStatus located in another class Profile (one to one relationship)

public class User {

    @Id
    @GeneratedValue(strategy = GenerationType.AUTO)
    private long id;

    @Column(nullable = false)
    private String username;

    @Column(nullable = false)
    private String password;

    @NotBlank
    @Size(max = 50)
    @Email
    private String email;

    @OneToOne(mappedBy = "user", cascade = CascadeType.ALL)
    private VerificationToken verificationToken;

    @Setter
    @OneToOne(cascade = CascadeType.PERSIST, mappedBy = "user")
    private Profile profile;
....
}

public class Profile {

    @Id
    @GeneratedValue(strategy = GenerationType.AUTO)
    @Column(name = "id", updatable = false, nullable = false)
    private Long id;

    @OneToOne(cascade = CascadeType.REMOVE)
    @JoinColumn(name = "id_user",unique = true)
    private User user;

    @NonNull
    String firstName;

    @NonNull
    String secondName;

    String userStatus ;

    @NonNull
    String phone;
...
}

I hear about aspectJs or maybe @PreAuthorize, but how to integrate them into /login api?

There is another way to achieve this by overriding UsernamePasswordAuthenticationFilter#attemptAuthentication (E.g: CustomUsernamePasswordAuthentication) and put your custom logic there (in your case, you should pass your service as parameter of the new class contructor as filter will not aware of spring component)

Can be done easily with @Aspect and using @Before advice from spring AOP. Define you join-points to intercepts specific api calls.

Take help from here