authentication failure reasons in IdP logs

[Kevin Foote]

On Jun 19, 2014, at 12:26 PM, David Bantz <dabantz at alaska.edu> wrote:
> 
> "Invalid Credentials," "Exceeded password retry limit," and "password expired" seem clear enough and reflect user failure to provide current valid password,
> but what about the other errors - "Inappropriate authentication" and "Cannot authenticate dn" - what states or events do they reflect in AD?

David, 

AD sends back “sub error” codes to the calling client.. 

You can field these in various places here is one approach I've used in the past:

Look at the Handling Login Errors section of this page [1] and its derivative page [2]


[1] <https://wiki.shibboleth.net/confluence/display/SHIB2/IdPAuthUserPassLoginPage>   
[2] <https://wiki.shibboleth.net/confluence/display/SHIB2/IdPAuthUserPassLoginPageMSADerror>


--------
thanks
 kevin.foote