IDP v3 Active Directory account state errors

[Cantor, Scott]

> In v2 we coded the error response from AD and a 'niceMsg' into the login
> page for the IDP, but in v3 it seems that this is now configured via adding
> some error states into password-authn-config.xml and authn-
> messages.properties.

You can do it however you want to do it, the templates are not hardwired.

> I added the snippets into my IDP, reloaded and I see the correct error
> response from AD in the idp-process log when I set net.shibboleth.idp to
> TRACE but nothing changed on the login page, it still has ' The password you
> entered was incorrect' as the error message.

The text it displays is based on the event. The event is InvalidCredentials. You map underlying error messages to events using the mapping table in password-authn-config.xml. If you want to change the text it displays, you either change the message property for the existing event or define a different event and add properties for it.

Or you ignore all of it and do whatever you want by hand in the template and just access the exception raised, essentially like in V2.

-- Scott