How to recognize distinct validation thrown by LDAP server and flags?

Question

We are new to LDAP server.

We were able to configure the ldap server with password policies such as

1. account lock out
2. Wrong Password
3. Password expired
4. 5 times wrong authentication
5. New password cannot be old password (Password History 5)

using LDAP PPOLICY Configuration

However we have an issue, For all validations thrown, LDAP server does not throw district validations. We want distinct validations.

For example, To show different messages depending upon number of consecutive failed authentication. Also if any account is locked recognizable flag required to display message that account has been locked.

How to recognize them distinctively??

We need to set a GUI on LDAP which prompts appropriate messages on for given validation or flag. Hint.: Logs are saved when validations generated.

Proposed: While saving log if we can also give/broadcast appropriate validation

Answer 1

After a lot of findings, finally found a quick solution on the web. Basically sending a second call just after authentication failed does the job - Thanks to Ricky Poderi

Answer 2

Put plainly, this is not possible through regular old LDAP.

The reason why is that, for your first four cases, per the LDAP RFC(4511), you will only receive an error code 49 indicating invalid credentials, and an error 53 in the last case, indicating operation not supported.

The protocol simply doesn't let you explain why the authentication failed, only that it did.

Part of this is for security - this way, an attacker only gets the login failure, they don't get extra information indicating why they failed, which would get them to shift tactics.

You would need some kind of middleware between your client and the LDAP server to handle this logic if you really want the distinct errors, but I strongly recommend you don't pursue this method if you can avoid it.