The issue was filed because letting a potential attacker know if the username or the password was wrong is generally seen as bad practice. Shibboleth as a project generally seems to strive for firstly shipping secure and secondly convenience. The filed issue could easily be resolved by defaulting to non-explicit errors and having doc (or just commented config) an admin could use to turn on the more explicit notifications.
Dave
--
David Langenberg
Asst Director, Identity Management
The University of Chicago
On 10/10/16, 5:31 PM, "users on behalf of Lipscomb, Gary" <users-bounces at shibboleth.net on behalf of glipscomb at csu.edu.au> wrote:
just get the administrator to change the text in authn-messages.properties
bad-username.message = The username you entered cannot be identified.
bad-password.message = The password you entered was incorrect.
expired-password.message = Your password has expired.
account-locked.message = Your account is locked.
Gary
> -----Original Message-----
> From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor,
> Scott
> Sent: Tuesday, 11 October 2016 5:38
> To: users at shibboleth.net (users at shibboleth.net) <users at shibboleth.net>
> Subject: Preference regarding reporting of authentication errors
>
> There's been a request that we stop shipping the IdP to report specific error
> causes to users in the default templates [1], and I'm agnostic about it myself
> (I don't agree with the issue being a concern, but I don't care what the
> default is), so i'm just going to ask for opinions by requesting that those who
> feel strongly about this go ahead and add a comment to that effect in the Jira
> issue. If a decent number want it changed, I'm happy to do so since it doesn't
> affect anybody's existing installation.
>
> Discussion here is fine, just want to avoid a lot of +1/-1 posts, and I'm not
> going to tally votes here.
>
> -- Scott
>
> [1] https://issues.shibboleth.net/jira/browse/IDP-1023
>
> --
> To unsubscribe from this list send an email to users-
> unsubscribe at shibboleth.net
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 8163 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/users/attachments/20161011/c3c18adf/attachment-0001.p7s>