Displaying LDAP login errors on login page

[Chad La Joie]

Yes, the exception is available and you have to dig in to it to get
the data.  JAAS just doesn't allow very good mechanisms for exposing
anything beyond "this didn't work".

On Wed, Mar 28, 2012 at 11:26, Charity Sipe <orders at charitylynn.net> wrote:
> Hello,
>
> I am using Shib + OpenLDAP for authentication.  I have password policies
> implemented on OpenLDAP for password expiry and account lockout after a
> specified number of unsuccessful login attempts.
>
> The problem is that "Credentials not recognized." is the only error given on
> the Shib login page no matter why the login failed - whether the user
> entered an invalid username/password, or their password expired or their
> account is locked out.  That isn't very descriptive, and it leaves the user
> not knowing what steps they need to take, if any (for example, if they have
> to update their expired password.)
>
> OpenLDAP does return an error code and string description when a password
> constraint is violated.  Is there anyway I can access this error message on
> the login page so that I can give the user a hint if they need to take some
> sort of action?  I looked at the available attributes and the only one that
> seems like an "error description" is authnException, but it's value is
> always
> "edu.internet2.middleware.shibboleth.idp.authn.AuthenticationException:
> javax.security.auth.login.LoginException: Cannot authenticate dn, invalid
> dn" so that isn't helpful.
>
> From the documentation, I don't see simple way to do this:
> https://wiki.shibboleth.net/confluence/display/SHIB2/IdPAuthUserPassLoginPage#IdPAuthUserPassLoginPage-HandlingLoginErrors
>
> But according the Chad La Joie's comment (made in early 2010) at the very
> bottom of the following issue, it seems he suggests that more information
> about the login failure would be made available to the JSP author.  Unless I
> am reading it incorrectly:
> https://bugs.internet2.edu/jira/browse/SIDP-368
>
> In any event, has anyone been able to get the error message returned from
> LDAP within the login page?  And if there is no way to get the error through
> Shib, has anyone implemented a work around?
>
> Any help would be much appreciated!
>
> Thanks and have a nice day!
>
> Charity
>
>
>
>
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net



-- 
Chad La Joie
www.itumi.biz
trusted identities, delivered