How to disallow the customer to login ? for example:

when a custom attribute is set to false

  • a custom attribute does this attribute belong to the customer entity or not? – Khoa TruongDinh Feb 11 at 7:22
  • belong to the customer entity – Robinio Tor Feb 11 at 12:57

magento Perform customer logic authorization from authenticate() method of Magento\Customer\Model\AccountManagement.

If i you want to prevent a customer from login basic of some condition then you can use this function.

Create around method on it and basic of throw the UserLockedException or EmailNotConfirmedException type error.

Plugin class:


namespace {Vendorname}\{ModuleName}\Plugin;

use Magento\Customer\Api\CustomerRepositoryInterface;
use Magento\Framework\Exception\InvalidEmailOrPasswordException;
use Magento\Framework\Exception\EmailNotConfirmedException;

class AccountManagement {
     * @var CustomerRepositoryInterface
    private $customerRepository;

    public function __construct(
     CustomerRepositoryInterface $customerRepository
      $this->customerRepository = $customerRepository;  
    public function aroundAuthenticate(
        \Magento\Customer\Model\AccountManagement $subject,
        \Closure $proceed,
        try {
            $customer = $this->customerRepository->get($username);
        } catch (NoSuchEntityException $e) {
            throw new InvalidEmailOrPasswordException(__('Invalid login or password.'));

        $CustomerfieldValue= $customer->getCustomAttribute('{Attribute_Code}')
            ? $customer->getCustomAttribute('{Attribute_Code}')->getValue()

        // Condition match throw error for prevent log
        if($CustomerfieldValue == true)
            throw new InvalidEmailOrPasswordException(__('Access is locked'));
            // access prevent
            // throw new EmailNotConfirmedException(__('Access is locked'));
        // Call original Method

        return $proceed($username,$password);
  • it is should be CustomerRepository. NOT registry. – Amit Bera Feb 11 at 8:05
  • Fatal error: Uncaught TypeError: Argument 2 passed to vendor\module\Plugin\AccountManagement::aroundAuthenticate() must be an instance of Clousure, instance of Closure given, called in vendor\module\framework\Interception\Interceptor.php on line 135 and defined in..... – Robinio Tor Feb 11 at 13:18
  • can you help me fix this error ? – Robinio Tor Feb 11 at 13:18
  • sure.let me check – Amit Bera Feb 11 at 13:19
  • Typo mistake Closure instead of Clousure – Amit Bera Feb 11 at 13:20

You can perform your customisation over the execute method of LoginPost controller in Magento\Customer\Controller\Account\LoginPost. Create a preference of this file and perform the needed changes.


Try this, Create the after plugin for isLocked function, return the result based on custom customer attribute. By this way, default Magento validating the customer before login.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.