IDP v3 Active Directory account state errors

[Craig Pluchinsky]

If your ldap Authn is set to adAuthenticator then you don't need the exact error codes. You can follow the wiki. At least that was my experience. 


On June 1, 2016 4:39:34 PM EDT, "Ginger, Anthony" <AGinger at miracosta.edu> wrote:
>Perfect, I added this as a test and it worked
>
>        <entry key="AccountLocked">
>             <list>
>                <value>533</value>
>             </list>
>        </entry>
>
>Question then, could the documentation
>https://wiki.shibboleth.net/confluence/display/IDP30/LDAPAuthnConfiguration
>
>that states for Active Directory  use
>
><entry key="AccountLocked">
>         <list>
>             <value>ACCOUNT_LOCKED_OUT</value>
>         </list>
>     </entry>
>
>Be changed or amended to include an example showing the error codes?
>
>Thanks
>Anthony
>
>-----Original Message-----
>From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor,
>Scott
>Sent: Wednesday, June 1, 2016 12:40 PM
>To: Shib Users <users at shibboleth.net>
>Subject: RE: IDP v3 Active Directory account state errors
>
>> In v2 we coded the error response from AD and a 'niceMsg' into the 
>> login page for the IDP, but in v3 it seems that this is now
>configured 
>> via adding some error states into password-authn-config.xml and
>authn- 
>> messages.properties.
>
>You can do it however you want to do it, the templates are not
>hardwired.
>
>> I added the snippets into my IDP, reloaded and I see the correct
>error 
>> response from AD in the idp-process log when I set net.shibboleth.idp
>
>> to TRACE but nothing changed on the login page, it still has ' The 
>> password you entered was incorrect' as the error message.
>
>The text it displays is based on the event. The event is
>InvalidCredentials. You map underlying error messages to events using
>the mapping table in password-authn-config.xml. If you want to change
>the text it displays, you either change the message property for the
>existing event or define a different event and add properties for it.
>
>Or you ignore all of it and do whatever you want by hand in the
>template and just access the exception raised, essentially like in V2.
>
>-- Scott
>
>--
>To unsubscribe from this list send an email to
>users-unsubscribe at shibboleth.net
>-- 
>To unsubscribe from this list send an email to
>users-unsubscribe at shibboleth.net
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160601/51c48c1c/attachment-0001.html>