!!! Overview As with most [LDAP Server Implementations], [EDirectory] provides some extended [LDAP Result Codes] that can help you determine more specific reasons for [Authentication Failures]. !! [EDirectory] [LDAP] [Result Codes] sub-codes for [Bind Response]: %%zebra-table %%sortable %%table-filter ||[LDAP Code|LDAP Result Codes]||[Hex]||[DEC]||Short Description||More Information|Comments |[49|LDAP_INVALID_CREDENTIALS]|FFFFFD63|-669|[LDAP_NO_SUCH_OBJECT]|Returns when [DN] or [password]/[credential] is invalid.|No [password Policy], [Account Restrictions] or [Time Restrictions] are set. Rather, this details the results when the user has actually typed the wrong password or [DN] (In eDirectory 8.8 SP1, a security enhancement was made when an invalid user does a Ldap bind. The return code for an invalid user now returns -669, instead of -601. |[49|LDAP_INVALID_CREDENTIALS]|FFFFFD63|-669|[ERROR_LOGON_FAILURE]|Returns when [DN] or [password]/[credential] is invalid.|No [password Policy], [Account Restrictions] or [Time Restrictions] are set. Rather, this details the results when the user has actually typed the wrong password or [DN] |[0|LDAP_SUCCESS]|FFFFFF21|-223|[ERROR_PASSWORD_EXPIRED]|[Password Expiration]: Password expired with [Grace Logins] remaining - [ERROR_PASSWORD_EXPIRED]|The administrator has set "Force [Password Changes]" and the user's password has expired. The number of grace logins has been limited, but some are still remaining.NOTE: this is a special case. The [authentication] is still successful since the bind operation can use one of the [Grace Logins] |[49|LDAP_INVALID_CREDENTIALS]|FFFFFF22|-222|[ERROR_PASSWORD_EXPIRED]|[Password Expiration]: [ERROR_PASSWORD_EXPIRED]|[Password] expired with no more [Grace Logins] |[53|LDAP_UNWILLING_TO_PERFORM]|FFFFFF24|-220|[ERROR_ACCOUNT_DISABLED|ACCOUNTDISABLE]|[Administratively Disabled]|NOTE: Returns only when presented with valid [username] and [password]/[credential]. |[53|LDAP_UNWILLING_TO_PERFORM]|FFFFFF24|-220|[ERROR_ACCOUNT_DISABLED|ACCOUNTDISABLE]|[Account Restriction]: [LoginExpirationTime] has been exceeded|NOTE: Returns only when presented with valid [username] and [password]/[credential]. |[53|LDAP_UNWILLING_TO_PERFORM]|FFFFFF26|-218|[ERROR_INVALID_LOGON_HOURS]|[Time Restriction]:Entry logon time restriction violation| The administrator has setup login [Time Restrictions] for the user, and she is attempting to authenticate outside of the allowed time. |[53|LDAP_UNWILLING_TO_PERFORM]|FFFFFF27 |-217|[MAXIMUM_LOGINS_EXCEEDED]|[Account Restriction]: [Concurrent Connections Exceeded|LoginMaximumSimultaneous]|An attempt was made to log in using an account that has limits on the number of concurrent connections ([LoginMaximumSimultaneous]), and that number has been reached. |[0|LDAP_SUCCESS]|FFFFFF25|-219|[ERROR_INVALID_WORKSTATION]|[Device Restriction]: Network Addresses Limited|An attempt to log in was made from an unauthorized station using an account with limits to a specific network and or station. (Note: this restriction is __NOT__ currently enforced through [LDAP]. The user will be able to authenticate successfully.) |[53|LDAP_UNWILLING_TO_PERFORM]|FFFFFF3B|-197|[ERROR_ACCOUNT_LOCKED_OUT]|[Intruder Detection]:The account is locked, as the intruder detection limits have been exceeded.|NOTE: Returns even if invalid password is presented /% /% /% !! Setup Used for These Tests In addition to creating the test accounts, the following also needs to be done: * The password policy must be setup and assigned to the users. (or the o=test container) * The o=test container must be setup to "detect intruders". {{{ # LDIF of locked accounts # ldapsearch -h ldap.willeke.com -b o=test,dc=com -s sub -D uid=isDisabled,o=test,dc=com -w novell "(cn=*)" # ldapsearch -h ldap.willeke.com -b o=test,dc=com -s sub -D uid=isINTRUDER,o=test,dc=com -w novell "(cn=*)" version: 1 # isACTIVE,people,willeke,com dn: uid=isACTIVE,o=test,dc=com uid: isACTIVE givenName: IS sn: ACTIVE objectClass: Top objectClass: Person objectClass: inetOrgPerson objectClass: organizationalPerson objectClass: ndsLoginProperties userpassword: novell cn: isACTIVE # isDisabled,people,willeke,com dn: uid=isDisabled,o=test,dc=com employeeType: E employeeStatus: A uid: isDisabled givenName: is sn: Disabled objectClass: inetOrgPerson objectClass: organizationalPerson objectClass: Person objectClass: ndsLoginProperties objectClass: Top loginDisabled: TRUE userpassword: novell cn: isDisabled # isINTRUDER,people,willeke,com dn: uid=isINTRUDER,o=test,dc=com uid: isINTRUDER givenName: is lockedByIntruder: TRUE sn: INTRUDER objectClass: Top objectClass: Person objectClass: inetOrgPerson objectClass: organizationalPerson objectClass: ndsLoginProperties loginIntruderResetTime: 20090323114029Z description: This account is Locked by too Many invlaid login attempts until 2009. Used for Testing. userpassword: novell cn: isINTRUDER # isPWDExpired,people,willeke,com dn: uid=isPWDExpired,o=test,dc=com uid: isPWDExpired givenName: IS sn: PWDExpired passwordExpirationTime: 20070102000000Z passwordExpirationInterval: 4838400 objectClass: Top objectClass: Person objectClass: inetOrgPerson objectClass: organizationalPerson objectClass: ndsLoginProperties userpassword: novell cn: isPWDExpired ### END OF FILE }}} !! Category %%category [eDirectory]%% !! More Information There might be more information for this subject on one of the following: [{ReferringPagesPlugin before='*' after='\n' }] ---- * [#1] - [LDAP errors returned when NDS login, password, time and address restrictions are set|https://support.novell.com/docs/Tids/Solutions/10067240.html|target='_blank'] - based on information obtained 2010-10-03