authentication failure reasons in IdP logs

[Daniel Fisher]

On Fri, Jun 20, 2014 at 7:34 PM, David Bantz <dabantz at alaska.edu> wrote:
> Thanks for your response Daniel.  I hope you will further indulge me,
> because your suggestion seems to me at odds with some aspects
> of what the logs appear to state.
>

I believe the answer to most of your questions is in the JAAS
documentation, specifically:
http://docs.oracle.com/javase/7/docs/api/javax/security/auth/login/LoginContext.html#login()
"In the case where multiple LoginModules fail, this method propagates
the exception raised by the first LoginModule which failed."

So the exception that is ultimately thrown and then logged whenever
both login modules fail is always the exception thrown from the first
module.

> In hopes of a more comfortable answer to those differences, here’s a
> slightly larger snippet from the same event(s), and contrasting output from
> other sequences.
> In each instance I’m providing pertinent log messages for BOTH the first
> (LDAP) and second (AD) modules.  These include interactions for which there
> is:
> 1 No DN in LDAP + Failed bind to AD DN = “invalid dn"

"invalid dn" is the exception thrown from the first module, since both
modules failed.

> 2 No DN in LDAP + No DN in AD = “invalid credential”

Did you supply an empty password for this test? The credential is
checked before the DN, so you would see that exception regardless of
DN resolution.

> 3 No DN in LDAP + Successful bind to AD DN = Successfully authenticated

The exception from the first module is discarded since the second
module succeeded. That's why you don't see it in your logs.

> 4 Failed bind to LDAP DN + Successful bind to AD DN = Successfully
> authenticated

The exception from the first module is discarded since the second
module succeeded.

> 5 Failed bind to LDAP DN + Failed bind to AD DN = “Invalid Credentials”

"Invalid Credentials" is the exception thrown from the first module,
but both exceptions are the same.

--Daniel Fisher