Displaying LDAP login errors on login page

[Kevin P. Foote]

Charity - 

This is do able with stock IdP (2.3.3 at least) using the provide 
username/password login handler and a custom login.jsp page.

As you found via reading SIDP-368 you have more info available to your
JSP parsing. 

I use MSAD but it will work the same in bubbling up the actual ldap
error to where you can use it at the JSP.

Using something like .. 
request.getAttribute(LoginHandler.AUTHENTICATION_EXCEPTION_KEY) you can
get at the exception object that is thrown by the underlying JAAS stack 
from within your JSP page. 

I parse this and give the user more info, account locked, user/pass
mismatch, etc..  You will of course have to know the error codes of your
ldap environment besides the generic "error code 49" :-) 

HTH ..If you need more just ask.. 

------
thanks
  kevin.foote

On Wed, 28 Mar 2012, Charity Sipe wrote:

-> Hello,
-> 
-> I am using Shib + OpenLDAP for authentication.  I have password policies
-> implemented on OpenLDAP for password expiry and account lockout after a
-> specified number of unsuccessful login attempts.
-> 
-> The problem is that "Credentials not recognized." is the only error given
-> on the Shib login page no matter why the login failed - whether the user
-> entered an invalid username/password, or their password expired or their
-> account is locked out.  That isn't very descriptive, and it leaves the user
-> not knowing what steps they need to take, if any (for example, if they have
-> to update their expired password.)
-> 
-> OpenLDAP does return an error code and string description when a password
-> constraint is violated.  Is there anyway I can access this error message on
-> the login page so that I can give the user a hint if they need to take some
-> sort of action?  I looked at the available attributes and the only one that
-> seems like an "error description" is authnException, but it's value is
-> always
-> "edu.internet2.middleware.shibboleth.idp.authn.AuthenticationException:
-> javax.security.auth.login.LoginException: Cannot authenticate dn, invalid
-> dn" so that isn't helpful.
-> 
-> >From the documentation, I don't see simple way to do this:
-> https://wiki.shibboleth.net/confluence/display/SHIB2/IdPAuthUserPassLoginPage#IdPAuthUserPassLoginPage-HandlingLoginErrors
-> 
-> But according the Chad La Joie's comment (made in early 2010) at the very
-> bottom of the following issue, it seems he suggests that more information
-> about the login failure would be made available to the JSP author.  Unless
-> I am reading it incorrectly:
-> https://bugs.internet2.edu/jira/browse/SIDP-368
-> 
-> In any event, has anyone been able to get the error message returned from
-> LDAP within the login page?  And if there is no way to get the error
-> through Shib, has anyone implemented a work around?
-> 
-> Any help would be much appreciated!
-> 
-> Thanks and have a nice day!
-> 
-> Charity
->