The Realm implementations are responsible for throwing a specific implementation to indicate why something failed.
The ActiveDirectory implementation (through it's parent class 'doGetAuthenticationInfo' implementation) merely wraps any thrown javax.naming.AuthenticationException or NamingException with a generic Shiro AuthenticationException indicating the failure. This is because javax.naming.AuthenticationException thrown when using JNDI doesn't give us a type-safe explanation of why it was thrown. You'd need an exception 'translator' of sorts that could read the javax.naming.AuthenticationException's 'explanation' String and convert that into a more specific Shiro type-safe AuthenticationException instance. It is a general practice to not give an end-user much information as to why their authentication attempt failed (e.g. 'Username or password incorrect.' is sufficient for most apps), because doing so could give a potential attacker more information on how to attack the system. Since most people prefer this more 'general' approach to showing login failures, no one has gone through the effort yet to create the exception 'translator'. Patches are always welcome of course! Best, -- Les Hazlewood Founder, Katasoft, Inc. Application Security Products & Professional Apache Shiro Support and Training: http://www.katasoft.com On Wed, Nov 24, 2010 at 9:55 AM, Garoad <[email protected]> wrote: > > In a small test example I threw together I noticed that when using the > ActiveDirectoryRealm, only AuthenticationException ever seems to get thrown, > regardless of what the issue was. In other words, I believe I recall (when > I was using something other than AD) seeing IncorrectCredentialsException, > or LockedAccountException, and so on (depending on the issue). But it seems > once I switched over to AD, I only get AuthenticationException. What could > be the reason(s)? > -- > View this message in context: > http://shiro-user.582556.n2.nabble.com/Exception-types-thrown-during-login-using-ActiveDirectoryRealm-tp5771260p5771260.html > Sent from the Shiro User mailing list archive at Nabble.com
