authenticator behavior with AD security context errors

[David Bantz]

On Mon, 10 Mar 2014, at 11:54 , Cantor, Scott <cantor.2 at osu.edu> wrote:

> On 3/10/14, 3:41 PM, "David Bantz" <dabantz at alaska.edu> wrote:
> 
>> How does the IdP¹s authentication handler, configured to query AD, react
>> to Œsecurity context errors¹ from AD that indicate the submitted password
>> did match that in the target record but the account is marked as ³not
>> permitted to login² or ³expired² (and other possible conditions)?
> 
> It doesn't. You'd need a custom login handler for that (mine uses message
> string matching to report that).
> 
> — Scott

To be explicit, within the distributed authN configured for ldap authN to AD, those conditions are functionally equivalent to failed authN, right?

David

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 163 bytes
Desc: Message signed with OpenPGP using GPGMail
Url : http://shibboleth.net/pipermail/users/attachments/20140310/989ae104/attachment.bin