<html><head><meta http-equiv="Content-Type" content="text/html charset=windows-1252"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">I’m attempting to track down instances of users’ failure to authenticate that is not merely entering incorrect or expired passwords.<div><br></div><div>The logs distinguish several types of failure to authenticate against AD, including at least these:</div><div><div><span class="Apple-tab-span" style="white-space: pre;"> </span>No user identified </div><div><span class="Apple-tab-span" style="white-space: pre;"> </span>error code 19 - Exceeded password retry limit. Account locked.</div><div><span class="Apple-tab-span" style="white-space: pre;"> </span>error code 48 - Inappropriate authentication</div><div><span class="Apple-tab-span" style="white-space: pre;"> </span>error code 49 - Invalid Credentials</div><div><span class="Apple-tab-span" style="white-space: pre;"> </span>error code 49 - password expired</div><div><span class="Apple-tab-span" style="white-space: pre;"> </span>Cannot authenticate dn, invalid dn [even though the bind appears to be against a dn provided by AD!]</div></div><div><br></div><div><div>"Invalid Credentials," "Exceeded password retry limit," and "password expired" seem clear enough and reflect user failure to provide current valid password,</div><div>but what about the other errors - "Inappropriate authentication" and "Cannot authenticate dn" - what states or events do they reflect in AD?</div></div><div><br></div><div>David Bantz</div><div>U Alaska </div><div><br></div><div><div class="gmail_extra"><div class="gmail_quote"><blockquote class="gmail_quote" style="margin: 0px 0px 0px 0.8ex; border-left-width: 1px; border-left-color: rgb(204, 204, 204); border-left-style: solid; padding-left: 1ex; position: static; z-index: auto;"><div style="word-wrap: break-word;"><div style="margin: 0px; font-size: 11px; font-family: Monaco; background-color: rgb(255, 250, 194); position: static; z-index: auto;">13:33:42.494 - INFO [edu.vt.middleware.ldap.jaas.JaasAuthenticator:180] - Authentication failed for dn: CN=jlrosenthal,OU=userAccounts,dc=ua,dc=ad,dc=alaska,dc=edu</div><div style="margin: 0px; font-size: 11px; font-family: Monaco; background-color: rgb(255, 250, 194); position: static; z-index: auto;">13:33:42.497 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.provider.UsernamePasswordLoginServlet:176] - User authentication for 31115951 failed</div><div style="margin: 0px; font-size: 11px; font-family: Monaco; background-color: rgb(255, 250, 194);">javax.security.auth.login.LoginException: Cannot authenticate dn, <span style="background-color: rgb(230, 230, 0);">invalid dn</span></div></div></blockquote></div></div></div><div><span class="Apple-tab-span" style="white-space:pre"> </span></div><div><div class="gmail_extra"><div class="gmail_quote"><blockquote class="gmail_quote" style="margin: 0px 0px 0px 0.8ex; border-left-width: 1px; border-left-color: rgb(204, 204, 204); border-left-style: solid; padding-left: 1ex; position: static; z-index: auto;"><div style="word-wrap: break-word;"><div style="margin: 0px; font-size: 11px; font-family: Monaco; background-color: rgb(255, 250, 194);">12:58:55.004 - INFO [edu.vt.middleware.ldap.jaas.JaasAuthenticator:180] - Authentication failed for dn: CN=jdskaling,OU=userAccounts,dc=ua,dc=ad,dc=alaska,dc=edu</div><div style="margin: 0px; font-size: 11px; font-family: Monaco; background-color: rgb(255, 250, 194);">12:58:55.006 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.provider.UsernamePasswordLoginServlet:176] - User authentication for 30490889 failed</div><div style="margin: 0px; font-size: 11px; font-family: Monaco; background-color: rgb(255, 250, 194);">javax.security.auth.login.LoginException: [LDAP: error code 48 - <span style="background-color: rgb(230, 230, 0);">Inappropriate</span> Authentication]</div></div></blockquote></div></div></div></body></html>