title: Prevent user to login based on custom attribute value
body: <p>I have a custom attribute which I'd like to use while authenticating. For example, I have another status extension attribute which can have possible values like expired/blocked/inactive/active. While creating the user I will ensure there is a value populated for this.</p>
  
  <p>At the time of login I'd like to consider this extension attribute as well. It may be possible that the user is entering the right password, but just because his extension attribute status has a value of expired/blocked/inactive I'd like to deny login and give a custom localized error message based on value of extension attribute. Which means if status is expired then i would like to show message as "Your account is expired. Please contact expired-account@xyz.com".
  if status is blocked then i would like to show message as "Your account is has been blcoked, please contact your local sales representative.</p>
  
  <p>If status is inactive then i would like to show message as "Your account has been inactive for more than 2 years. Please use <a href="https://Activatemyaccoutn.com" rel="nofollow noreferrer">activate account</a> to activate your account" In this message i would like to have link rendered in message if possible. </p>
  
  <p>I would like to use this messages to be localized.</p>
  
  <p>Note: I'm using custom policies.</p>
  
  <p>I have used below link to implement something similar but it only works with in black and white mode which means if status is active then allowed to login else for any other status it shows the same message.
  <a href="https://stackoverflow.com/questions/55291570/prevent-deny-login-to-user-based-on-extension-attribute">Prevent/deny login to user based on extension attribute</a>. Please dont confuse with this link as the requirements are different. </p>
  
  <p>I would also like to use this extra step of verification in Password reset policy too. Thing is that Password reset policy gets the password changed by taking user input but as soon as password change process is done it just issues the token. My requirement is that if status is expired/blocked/inactive then even after changing the password they should not be able to login. </p>