<html><head></head><body>If your ldap Authn is set to adAuthenticator then you don't need the exact error codes. You can follow the wiki. At least that was my experience. <br>
<br><br><div class="gmail_quote">On June 1, 2016 4:39:34 PM EDT, "Ginger, Anthony" <AGinger@miracosta.edu> wrote:<blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
<pre class="k9mail">Perfect, I added this as a test and it worked<br /><br /> <entry key="AccountLocked"><br /> <list><br /> <value>533</value><br /> </list><br /> </entry><br /><br />Question then, could the documentation <a href="https://wiki.shibboleth.net/confluence/display/IDP30/LDAPAuthnConfiguration">https://wiki.shibboleth.net/confluence/display/IDP30/LDAPAuthnConfiguration</a><br /><br />that states for Active Directory use<br /><br /><entry key="AccountLocked"><br /> <list><br /> <value>ACCOUNT_LOCKED_OUT</value><br /> </list><br /> </entry><br /><br />Be changed or amended to include an example showing the error codes?<br /><br />Thanks<br />Anthony<br /><br />-----Original Message-----<br />From: users [mailto:users-bounces@shibboleth.net] On Behalf Of Cantor, Scott<br />Sent: Wednesday, June 1, 2016 12:40 PM<br
/>To: Shib Users <users@shibboleth.net><br />Subject: RE: IDP v3 Active Directory account state errors<br /><br /><blockquote class="gmail_quote" style="margin: 0pt 0pt 1ex 0.8ex; border-left: 1px solid #729fcf; padding-left: 1ex;"> In v2 we coded the error response from AD and a 'niceMsg' into the <br /> login page for the IDP, but in v3 it seems that this is now configured <br /> via adding some error states into password-authn-config.xml and authn- <br /> messages.properties.<br /></blockquote><br />You can do it however you want to do it, the templates are not hardwired.<br /><br /><blockquote class="gmail_quote" style="margin: 0pt 0pt 1ex 0.8ex; border-left: 1px solid #729fcf; padding-left: 1ex;"> I added the snippets into my IDP, reloaded and I see the correct error <br /> response from AD in the idp-process log when I set net.shibboleth.idp <br /> to TRACE but nothing changed on the login page, it still has ' The <br /> password you entered was incorrect' as the error
message.<br /></blockquote><br />The text it displays is based on the event. The event is InvalidCredentials. You map underlying error messages to events using the mapping table in password-authn-config.xml. If you want to change the text it displays, you either change the message property for the existing event or define a different event and add properties for it.<br /><br />Or you ignore all of it and do whatever you want by hand in the template and just access the exception raised, essentially like in V2.<br /><br />-- Scott<br /><br />--<br />To unsubscribe from this list send an email to users-unsubscribe@shibboleth.net</pre></blockquote></div></body></html>