<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">On 6/19/2014 2:26 PM, David Bantz
wrote:<br>
</div>
<blockquote
cite="mid:DF2A62C3-1629-40C0-97B5-1595FF630094@Alaska.edu"
type="cite">
<div>The logs distinguish several types of failure to authenticate
against AD, including at least these:</div>
<div>
<div><span class="Apple-tab-span" style="white-space: pre;"> </span>No
user identified </div>
<div><span class="Apple-tab-span" style="white-space: pre;"> </span>error
code 19 - Exceeded password retry limit. Account locked.</div>
<div><span class="Apple-tab-span" style="white-space: pre;"> </span>error
code 48 - Inappropriate authentication</div>
<div><span class="Apple-tab-span" style="white-space: pre;"> </span>error
code 49 - Invalid Credentials</div>
<div><span class="Apple-tab-span" style="white-space: pre;"> </span>error
code 49 - password expired</div>
<div><span class="Apple-tab-span" style="white-space: pre;"> </span>Cannot
authenticate dn, invalid dn [even though the bind appears to
be against a dn provided by AD!]</div>
</div>
<div><br>
</div>
<div>
<div>"Invalid Credentials," "Exceeded password retry limit," and
"password expired" seem clear enough and reflect user failure
to provide current valid password,</div>
<div>but what about the other errors - "Inappropriate
authentication" and "Cannot authenticate dn" - what states or
events do they reflect in AD?</div>
</div>
</blockquote>
<br>
Anything with an error code is standard LDAP, so generic
descriptions should apply:<br>
<br>
LDAP_INAPPROPRIATE_AUTH<br>
Inappropriate authentication was specified, for example,
LDAP_AUTH_SIMPLE was specified and the entry does not have a
userPassword attribute.<br>
<br>
The "invalid dn" is from VT-LDAP, and indicates that the search for
the user failed (i.e. the userFilter did not match any users).
Nothing to do with the bindDn (unless the issue is that the bindDn
doesn't have sufficient access to see the target user).<br>
<br>
<pre class="moz-signature" cols="72">--
%% Christopher A. Bongaarts %% <a class="moz-txt-link-abbreviated" href="mailto:cab@umn.edu">cab@umn.edu</a> %%
%% OIT - Identity Management %% <a class="moz-txt-link-freetext" href="http://umn.edu/~cab">http://umn.edu/~cab</a> %%
%% University of Minnesota %% +1 (612) 625-1809 %%
</pre>
</body>
</html>