idp v3 authentication - The username you entered cannot be identified

[Nate Klingenstein]

> when logging in with valid credentials the SP reports back "The username you entered cannot be identified.”

It depends on the SP implementation, but “it's a trap”.  SAML has a unique method of relaying authentication failures built into the protocol which is rarely used for any other failure.  It happens at the IdP, but the SP reports it.  You should see the protocol message if you crank up logs.

> and logs in idp-warn.log as "Profile Action ValidateUsernamePasswordAgainstLDAP: Login by 'user1' failed" - IdP seems to load LDAP correctly.

I wouldn’t be surprised if that Velocity error were crippling the IdP as it went to load another view.  A lot of those implementations presume that if part is broken, all is broken, as a way to make sure configuration mistakes result in up-front failures rather than data leakage or worse.

Hope this helps,
Nate.