On Mon, 2006-06-05 at 21:55 -0600, Ole Craig wrote: [...] > Error 49 is the generic LDAP error returned when the account you're > using to bind (NOT the account you're trying to authenticate) has > invalid credentials, usually a bad or expired password but not always. > Active Directory returns a cryptic sub-error code: > > http://forum.java.sun.com/thread.jspa?forumID=51&threadID=658510 [...]
Hmm. That link has changed since I scraped it into an internal technote, or else I pasted the wrong link. For anyone who might find it useful, here's a more complete version, and my heartfelt thanks go to whomever was the original poster on the java forum. Following are the results of somebody's "experimentation" with a W2k Domain Controller... Common Active Directory LDAP bind errors: 80090308: LdapErr: DSID-0C09030B, comment: AcceptSecurityContext error, data 525, v893 HEX: 0x525 - user not found DEC: 1317 - ERROR_NO_SUCH_USER (The specified account does not exist.) NOTE: Returns when username is invalid. 80090308: LdapErr: DSID-0C09030B, comment: AcceptSecurityContext error, data 52e, v893 HEX: 0x52e - invalid credentials DEC: 1326 - ERROR_LOGON_FAILURE (Logon failure: unknown user name or bad password.) NOTE: Returns when username is valid but password/credential is invalid. Will prevent most other errors from being displayed as noted. 80090308: LdapErr: DSID-0C09030B, comment: AcceptSecurityContext error, data 530, v893 HEX: 0x530 - not permitted to logon at this time DEC: 1328 - ERROR_INVALID_LOGON_HOURS (Logon failure: account logon time restriction violation.) NOTE: Returns only when presented with valid username and password/credential. 80090308: LdapErr: DSID-0C09030B, comment: AcceptSecurityContext error, data 531, v893 HEX: 0x531 - not permitted to logon from this workstation DEC: 1329 - ERROR_INVALID_WORKSTATION (Logon failure: user not allowed to log on to this computer.) LDAP[userWorkstations: <multivalued list of workstation names>] NOTE: Returns only when presented with valid username and password/credential. 80090308: LdapErr: DSID-0C09030B, comment: AcceptSecurityContext error, data 532, v893 HEX: 0x532 - password expired DEC: 1330 - ERROR_PASSWORD_EXPIRED (Logon failure: the specified account password has expired.) LDAP[userAccountControl: <bitmask=0x00800000>] - PASSWORDEXPIRED NOTE: Returns only when presented with valid username and password/credential. 80090308: LdapErr: DSID-0C09030B, comment: AcceptSecurityContext error, data 533, v893 HEX: 0x533 - account disabled DEC: 1331 - ERROR_ACCOUNT_DISABLED (Logon failure: account currently disabled.) LDAP[userAccountControl: <bitmask=0x00000002>] - ACCOUNTDISABLE NOTE: Returns only when presented with valid username and password/credential. 80090308: LdapErr: DSID-0C09030B, comment: AcceptSecurityContext error, data 701, v893 HEX: 0x701 - account expired DEC: 1793 - ERROR_ACCOUNT_EXPIRED (The user's account has expired.) LDAP[accountExpires: <value of -1, 0, or extemely large value indicates account will not expire>] - ACCOUNTEXPIRED NOTE: Returns only when presented with valid username and password/credential. 80090308: LdapErr: DSID-0C09030B, comment: AcceptSecurityContext error, data 773, v893 HEX: 0x773 - user must reset password DEC: 1907 - ERROR_PASSWORD_MUST_CHANGE (The user's password must be changed before logging on the first time.) LDAP[pwdLastSet: <value of 0 indicates admin-required password change>] - MUST_CHANGE_PASSWD NOTE: Returns only when presented with valid username and password/credential. 80090308: LdapErr: DSID-0C09030B, comment: AcceptSecurityContext error, data 775, v893 HEX: 0x775 - account locked out DEC: 1909 - ERROR_ACCOUNT_LOCKED_OUT (The referenced account is currently locked out and may not be logged on to.) LDAP[userAccountControl: <bitmask=0x00000010>] - LOCKOUT NOTE: Returns even if invalid password is presented -- /Ole Craig Security Engineer 303-381-3802 (main support hotline) 303-381-3824 (my direct line) 303-381-3801 (fax) www.stillsecure.com . . . _______________________________________________ http://lists.bestpractical.com/cgi-bin/mailman/listinfo/rt-users Community help: http://wiki.bestpractical.com Commercial support: [EMAIL PROTECTED] Discover RT's hidden secrets with RT Essentials from O'Reilly Media. Buy a copy at http://rtbook.bestpractical.com We're hiring! Come hack Perl for Best Practical: http://bestpractical.com/about/jobs.html
