authentication failure reasons in IdP logs

[Christopher Bongaarts]

On 6/19/2014 2:26 PM, David Bantz wrote:
> The logs distinguish several types of failure to authenticate against 
> AD, including at least these:
> No user identified
> error code 19 - Exceeded password retry limit.  Account locked.
> error code 48 - Inappropriate authentication
> error code 49 - Invalid Credentials
> error code 49 - password expired
> Cannot authenticate dn, invalid dn [even though the bind appears to be 
> against a dn provided by AD!]
>
> "Invalid Credentials," "Exceeded password retry limit," and "password 
> expired" seem clear enough and reflect user failure to provide current 
> valid password,
> but what about the other errors - "Inappropriate authentication" and 
> "Cannot authenticate dn" - what states or events do they reflect in AD?

Anything with an error code is standard LDAP, so generic descriptions 
should apply:

LDAP_INAPPROPRIATE_AUTH
Inappropriate authentication was specified, for example, 
LDAP_AUTH_SIMPLE was specified and the entry does not have a 
userPassword attribute.

The "invalid dn" is from VT-LDAP, and indicates that the search for the 
user failed (i.e. the userFilter did not match any users). Nothing to do 
with the bindDn (unless the issue is that the bindDn doesn't have 
sufficient access to see the target user).

-- 
%%  Christopher A. Bongaarts   %%  cab at umn.edu          %%
%%  OIT - Identity Management  %%  http://umn.edu/~cab  %%
%%  University of Minnesota    %%  +1 (612) 625-1809    %%

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20140619/b24bf51f/attachment.html