Password flow with Kerberos bad password unclassified

[Scott Koranda]

Hello,

We are using IdP 3.2.1 with

.../conf/authn/password-authn-config.xml

containing

<import resource="krb5-authn-config.xml" />

The flow works well.

When, however, a user enters an incorrect password then the
login-error.vm template is "seeing" an unclassified error and
diplaying the result of

$loginException.getMessage()

The text displayed is "Checksum failed".

Am I correct that if I edit

<util:map id="shibboleth.authn.Password.ClassifiedMessageMap">

in password-authn-config.xml, and specifically if I change

<entry key="InvalidPassword">
    <list>
        <value>InvalidCredentials</value>
        <value>PREAUTH_FAILED</value>
        <value>INVALID_CREDENTIALS</value>
    </list>
</entry>

to be instead

<entry key="InvalidPassword">
    <list>
        <value>InvalidCredentials</value>
        <value>PREAUTH_FAILED</value>
        <value>INVALID_CREDENTIALS</value>
        <value>Checksum failed</value>
    </list>
</entry>

then the error will go from being "unclassified" to "classified"?

If I am correct, should such a change be included in the default?

Thanks,

Scott K