authentication failure reasons in IdP logs

[David Bantz]

I’m attempting to track down instances of users’ failure to authenticate that is not merely entering incorrect or expired passwords.

The logs distinguish several types of failure to authenticate against AD, including at least these:
	No user identified 
	error code 19 - Exceeded password retry limit.  Account locked.
	error code 48 - Inappropriate authentication
	error code 49 - Invalid Credentials
	error code 49 - password expired
	Cannot authenticate dn, invalid dn [even though the bind appears to be against a dn provided by AD!]

"Invalid Credentials," "Exceeded password retry limit," and "password expired" seem clear enough and reflect user failure to provide current valid password,
but what about the other errors - "Inappropriate authentication" and "Cannot authenticate dn" - what states or events do they reflect in AD?

David Bantz
U Alaska 

13:33:42.494 - INFO [edu.vt.middleware.ldap.jaas.JaasAuthenticator:180] - Authentication failed for dn: CN=jlrosenthal,OU=userAccounts,dc=ua,dc=ad,dc=alaska,dc=edu
13:33:42.497 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.provider.UsernamePasswordLoginServlet:176] - User authentication for 31115951 failed
javax.security.auth.login.LoginException: Cannot authenticate dn, invalid dn
	
12:58:55.004 - INFO [edu.vt.middleware.ldap.jaas.JaasAuthenticator:180] - Authentication failed for dn: CN=jdskaling,OU=userAccounts,dc=ua,dc=ad,dc=alaska,dc=edu
12:58:55.006 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.provider.UsernamePasswordLoginServlet:176] - User authentication for 30490889 failed
javax.security.auth.login.LoginException: [LDAP: error code 48 - Inappropriate Authentication]
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20140619/a5a2a186/attachment.html 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 163 bytes
Desc: Message signed with OpenPGP using GPGMail
Url : http://shibboleth.net/pipermail/users/attachments/20140619/a5a2a186/attachment.bin