@Override
    public CredentialValidationResult validateCredentials(final String userId, final String password) {
        if (Strings.isNullOrEmpty(userId)
            || Strings.isNullOrEmpty(password)) {
            return new CredentialValidationResult(false, true, false, false, false, false);
        }

        Optional<AccountRecord> optionalRecord = JooqUtil.contextResult(identityDbConnProvider, context -> context
                .selectFrom(ACCOUNT)
                .where(ACCOUNT.USER_ID.eq(userId))
                .fetchOptional());

        // Create the admin account if it doesn't exist.
        if (optionalRecord.isEmpty() && User.ADMIN_USER_SUBJECT_ID.equals(userId)) {
            final long now = System.currentTimeMillis();
            final Account account = new Account();
            account.setUserId(User.ADMIN_USER_SUBJECT_ID);
            account.setNeverExpires(true);
            account.setForcePasswordChange(true);
            account.setCreateTimeMs(now);
            account.setCreateUser("INTERNAL_PROCESSING_USER");
            account.setUpdateTimeMs(now);
            account.setUpdateUser("INTERNAL_PROCESSING_USER");
            account.setEnabled(true);
            tryCreate(account, User.ADMIN_USER_SUBJECT_ID);

            optionalRecord = JooqUtil.contextResult(identityDbConnProvider, context -> context
                    .selectFrom(ACCOUNT)
                    .where(ACCOUNT.USER_ID.eq(userId))
                    .fetchOptional());
        }

        if (optionalRecord.isEmpty()) {
            LOGGER.debug("Request to log in with invalid user id: " + userId);
            return new CredentialValidationResult(
                    false,
                    true,
                    false,
                    false,
                    false,
                    false);
        }

        final AccountRecord record = optionalRecord.get();
        boolean isPasswordCorrect = PasswordHashUtil.checkPassword(password, record.getPasswordHash());
        boolean isDisabled = !record.getEnabled();
        boolean isInactive = record.getInactive();
        boolean isLocked = record.getLocked();
        boolean isProcessingAccount = record.getProcessingAccount();

        return new CredentialValidationResult(
                isPasswordCorrect, false, isLocked, isDisabled, isInactive, isProcessingAccount);
    }
Create a derived field that represents the account state.
stroom-security/stroom-security-identity-db/src/main/java/stroom/security/identity/db/AccountDaoImpl.java