bring error hints from CustomAuthenticators extending AbstractAuthenticator back to the client.

• Key: DIRSERVER-640
• Type: Improvement
• Status: Open
• Priority: Major
• Assignee: Unassigned
• Reporter: Ralf Hauser
• Component/s: ldap
• Affects Version/s: 1.0-RC3
• Fix Version/s: 2.0.0-RC1

Description

For the authentication, I use a CustomAuthenticator that extends AbstractAuthenticator.

If the authentication fails I use LdapAuthenticationException or LdapNoPermissionException and I appreciate a lot to be able to provide some hint (String explanation) why the exception was thrown.

Unfortunately, this hint never reaches the client. I only sees "error code 49 - Bind failed" - the equivalent is visible in the server log as
<<Ldap Result
            Result code : (ResultCodeEnum[INVALIDCREDENTIALS=49]) invalidCredentials
            Matched DN : 'null'
            Error message : 'Bind failed'>>

It appears that the culprit is org.apache.directory.server.core.authn.AuthenticationService.bind(NextInterceptor next, Name bindDn, byte[] credentials, List mechanisms, String saslAuthId) throws NamingException

 where that expception is caught, neither its class is analyzed in detail nor is there any attempt to use "explanations" when re-throwing even though an LdapAuthenticationException constructor does exist that takes a "msg" for explanations.

Therefore my suggestion: please make sure that it is possible to provide a user more information by optionally appending an "explantion" to the 'Bind failed' a client currently sees in an ldap client.

Comments

[Ralf Hauser]

see also DIRSERVER-649

[Emmanuel Lecharny]

Postponed

[Alex Karasulu]

Postponed for authn/authz push in 1.5.6 when all these issues can be tackled.

[Emmanuel Lecharny]

Moved to 2.0.0-RC1, we won't release a 1.5.6