Hello,<br><br>I am using Shib + OpenLDAP for authentication. I have password policies implemented on OpenLDAP for password expiry and account lockout after a specified number of unsuccessful login attempts.<br><br>The problem is that "Credentials not recognized." is the only error given on the Shib login page no matter why the login failed - whether the user entered an invalid username/password, or their password expired or their account is locked out. That isn't very descriptive, and it leaves the user not knowing what steps they need to take, if any (for example, if they have to update their expired password.)<br>
<br>OpenLDAP does return an error code and string description when a password constraint is violated. Is there anyway I can access this error message on the login page so that I can give the user a hint if they need to take some sort of action? I looked at the available attributes and the only one that seems like an "error description" is authnException, but it's value is always "edu.internet2.middleware.shibboleth.idp.authn.AuthenticationException: javax.security.auth.login.LoginException: Cannot authenticate dn, invalid dn" so that isn't helpful.<br>
<br>From the documentation, I don't see simple way to do this:<br><a href="https://wiki.shibboleth.net/confluence/display/SHIB2/IdPAuthUserPassLoginPage#IdPAuthUserPassLoginPage-HandlingLoginErrors">https://wiki.shibboleth.net/confluence/display/SHIB2/IdPAuthUserPassLoginPage#IdPAuthUserPassLoginPage-HandlingLoginErrors</a><br>
<br>But according the Chad La Joie's comment (made in early 2010) at the very bottom of the following issue, it seems he suggests that more information about the login failure would be made available to the JSP author. Unless I am reading it incorrectly:<br>
<a href="https://bugs.internet2.edu/jira/browse/SIDP-368">https://bugs.internet2.edu/jira/browse/SIDP-368</a><br><br>In any event, has anyone been able to get the error message returned from LDAP within the login page? And if there is no way to get the error through Shib, has anyone implemented a work around?<br>
<br>Any help would be much appreciated!<br><br>Thanks and have a nice day!<br><br>Charity<br><br><br><br><br>