Expired Password message not displaying. IdP v5

[Cantor, Scott]

> This worked OK in Identity Provider 4 without changing the
> order but something has changed in Identity Provider 5
> Both systems are using the same openLDAP instance.

The only change in 5 is that if it *can't* attach a classified/mapped value based on the message, it slaps the signaled event into the AuthenticationErrorContext, so for example you might see "InvalidCredentials" in the set where it wasn't before.

That was a fix so that we wouldn't have to do all sorts of identity mappings of "check for InvalidCredentials and map it to InvalidCredentials".

Those are all camel-case, not all caps, so that partcular value isn't coming from the IdP.

Testing against error strings is not ever going to be stable or consistent, it's just a workaround to deal with the lack of fine-grained signaling out of most libraries.

The entire LDAP client stack is different, so I have no doubt the values coming out of it are also.

-- Scott