Displaying LDAP login errors on login page

[Charity Sipe]

Hello,

I am using Shib + OpenLDAP for authentication.  I have password policies
implemented on OpenLDAP for password expiry and account lockout after a
specified number of unsuccessful login attempts.

The problem is that "Credentials not recognized." is the only error given
on the Shib login page no matter why the login failed - whether the user
entered an invalid username/password, or their password expired or their
account is locked out.  That isn't very descriptive, and it leaves the user
not knowing what steps they need to take, if any (for example, if they have
to update their expired password.)

OpenLDAP does return an error code and string description when a password
constraint is violated.  Is there anyway I can access this error message on
the login page so that I can give the user a hint if they need to take some
sort of action?  I looked at the available attributes and the only one that
seems like an "error description" is authnException, but it's value is
always
"edu.internet2.middleware.shibboleth.idp.authn.AuthenticationException:
javax.security.auth.login.LoginException: Cannot authenticate dn, invalid
dn" so that isn't helpful.

>From the documentation, I don't see simple way to do this:
https://wiki.shibboleth.net/confluence/display/SHIB2/IdPAuthUserPassLoginPage#IdPAuthUserPassLoginPage-HandlingLoginErrors

But according the Chad La Joie's comment (made in early 2010) at the very
bottom of the following issue, it seems he suggests that more information
about the login failure would be made available to the JSP author.  Unless
I am reading it incorrectly:
https://bugs.internet2.edu/jira/browse/SIDP-368

In any event, has anyone been able to get the error message returned from
LDAP within the login page?  And if there is no way to get the error
through Shib, has anyone implemented a work around?

Any help would be much appreciated!

Thanks and have a nice day!

Charity
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20120328/0ed10228/attachment.html