Spring ldap authentication failed error codes

Question

I'm using Spring LDAP (1.3.1) to talk to ADAM and Active Directory.

When I try to authenticate someone using ldapTemplate.authenticate() I get back errors via the error callback, but it gives a very generic exception AuthenticationException and I cannot extract what exactly is the problem:

account disabled
password expired
must change password on next login
account expired
etc

All I get back is a detailMessage which I assume is what AD sends back. Something like:

org.springframework.ldap.AuthenticationException: [LDAP: error code 49 - 8009030C: LdapErr: DSID-0C0903A9, comment: AcceptSecurityContext error, data 773, v1db0

I can see data 773, which means the user must change the password at next login. I don't want to parse this manually. Are there any "adapters" I am not aware of?

Did anyone ever had this problem?

Thanks a lot!

Raghuram · Accepted Answer · 2010-12-15 05:38:48Z

4

This link lists how ldap error codes map to JNDI Exceptions. Looking at spring ldap code, it appears that spring maps each JNDI exception to its custom LDAP exception (LdapUtils.convertLdapException())

Now, 773 seems specfic to Active Directory. Hence this needs to be handled by user explicitly, if required. This link lists a bunch of Active Directory errors. Spring ldap would provide this text in its error details, leaving the user to use them as suitable.

answered Dec 15, 2010 at 5:38

Raghuram

52.8k11 gold badges114 silver badges124 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

inor · Accepted Answer · 2012-11-12 09:01:21Z

0

if your code ends up in PasswordPolicyAwareContextSource.getContext or in similar spring code, Spring does not handle it very well (bug).
When the account is expired an exception is thrown. the above class catches this exception and then, and this is the key, it calls
PasswordPolicyResponseControl ctrl = PasswordPolicyControlExtractor.extractControl(ctx);
Spring then calls ctrl.isLocked() but fails to check for any of the other conditions. You should override Spring's code, and you can check ctrl.isExpired(), ctrl.isChangeAfterReset(), and a bunch of other information getters are available there at that point

answered Nov 12, 2012 at 9:01

inor

2,8662 gold badges36 silver badges44 bronze badges

Collectives™ on Stack Overflow

Spring ldap authentication failed error codes

2 Answers 2

Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related