IDP v3 Active Directory account state errors

[Ginger, Anthony]

Perfect, I added this as a test and it worked

        <entry key="AccountLocked">
             <list>
                <value>533</value>
             </list>
        </entry>

Question then, could the documentation https://wiki.shibboleth.net/confluence/display/IDP30/LDAPAuthnConfiguration

that states for Active Directory  use

<entry key="AccountLocked">
         <list>
             <value>ACCOUNT_LOCKED_OUT</value>
         </list>
     </entry>

Be changed or amended to include an example showing the error codes?

Thanks
Anthony

-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Wednesday, June 1, 2016 12:40 PM
To: Shib Users <users at shibboleth.net>
Subject: RE: IDP v3 Active Directory account state errors

> In v2 we coded the error response from AD and a 'niceMsg' into the 
> login page for the IDP, but in v3 it seems that this is now configured 
> via adding some error states into password-authn-config.xml and authn- 
> messages.properties.

You can do it however you want to do it, the templates are not hardwired.

> I added the snippets into my IDP, reloaded and I see the correct error 
> response from AD in the idp-process log when I set net.shibboleth.idp 
> to TRACE but nothing changed on the login page, it still has ' The 
> password you entered was incorrect' as the error message.

The text it displays is based on the event. The event is InvalidCredentials. You map underlying error messages to events using the mapping table in password-authn-config.xml. If you want to change the text it displays, you either change the message property for the existing event or define a different event and add properties for it.

Or you ignore all of it and do whatever you want by hand in the template and just access the exception raised, essentially like in V2.

-- Scott

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net