Displaying LDAP login errors on login page

[Cantor, Scott]

> OpenLDAP does return an error code and string description when a password
> constraint is violated.

What matters is what the JAAS login module returns, not what OpenLDAP does. (Not that it doesn't give you something, just saying.) When using AD, I get back the specific codes inside the error messages, so I think it's probably possible.

> In any event, has anyone been able to get the error message returned from
> LDAP within the login page?  And if there is no way to get the error through
> Shib, has anyone implemented a work around?

I use a custom login handler, as I believe all sites that are serious about deploying an IdP must/will eventually.

-- Scott