Error Codes from LDAP / Microsoft Active Directory authentication

[Douglas E. Engert]

On 5/21/2013 9:00 AM, Yusuf Tran wrote:
> Hi Guys,
>
> I've been doing some R&D online over the last few days and am trying to find a way to detect the Microsoft Active Directory (AD) error codes, such that I can detect when an account is disabled, locked, or just can't authenticate.
>

You can use an LDAP query to test bits in AD for example to only accept non disabled accounts:

(&(objectClass=user)(sAMAccountName=$instancePrincipalName.get(0))(extensionAttribute1=Y)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))

http://support.microsoft.com/kb/269181



> Have read and tried emulating various guides with no success:
>
> Refs
>
> http://support.microsoft.com/kb/155012
> https://bugs.internet2.edu/jira/browse/SIDP-368
> http://shibboleth.1660669.n2.nabble.com/Displaying-LDAP-login-errors-on-login-page-td7414097.html

>
>
> The goal is to give students specific directions on the IDP login page based on the error codes.

Pass the userAccountControl field to a script to test the bits and display the messages.


>
> Redhat 6.4 - Shibboleth IDP - 2.3.8
> Windows Server 2008 R2 - AD
>
> Is there a clear cut way to enable this or a guide compatible with 2.3.8?
>
> Regards
> Yusuf
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
>

-- 

  Douglas E. Engert  <DEEngert at anl.gov>
  Argonne National Laboratory
  9700 South Cass Avenue
  Argonne, Illinois  60439
  (630) 252-5444