anomalies with LDAP failure messaging

[Cantor, Scott]

On 6/2/17, 9:54 PM, "users on behalf of IAM David Bantz" <users-bounces at shibboleth.net on behalf of dabantz at alaska.edu> wrote:

> It seems these should be distinguished.

Well, I didn't make the built-in one configurable, but if you want to distinguish them then map the LDAP error strings into something other than AccountLocked and handle it as a custom event with its own error message properties.

> 2. With multiple directories for authN in JAAS.config denoted "sufficient," a user that fails to be found (no directory entry) in a
> directory, then is found in a subsequent directory, but fails authN because of an invalid password, receives the "not found"
> error message on the login page. This is of course mis-leading to the user who has been found in a second or third directory
> source, but failed instead because they submitted an incorrect password.

My error handling uses logic like this:

#if ($authenticationErrorContext && $authenticationErrorContext.getClassifiedErrors().size() > 0 && $authenticationErrorContext.getClassifiedErrors().iterator().next() != "ReselectFlow")
    ## This handles errors that are classified by the message maps in the authentication config.
    #if ($authenticationErrorContext.getClassifiedErrors().contains("InvalidPassword"))
        #set ($eventId = "InvalidPassword")
    #elseif ($authenticationErrorContext.getClassifiedErrors().contains("AccountLocked"))
        #set ($eventId = "AccountLocked")
    #elseif ($authenticationErrorContext.getClassifiedErrors().contains("AccountDisabled"))
etc.

It lets me prioritize which mapped outcome to report. You should take care though because any time there are multiple back-ends, you'll get some weird edge cases with virtually any order of reporting you pick.

-- Scott