LDAP连接认证错误类型
ldap连接错误类型:
INVALID_CREDENTIALS: 80090308: LdapErr: DSID-0C09042F, comment: AcceptSecurityContext error, data 52e, v2580
INVALID_CREDENTIALS: 80090308: LdapErr: DSID-0C090400, comment: AcceptSecurityContext error, data 775, v1db1
Error code | Error | Description |
---|---|---|
525 | User not found | Returned when an invalid username is supplied. |
52e | Invalid credentials | Returned when a valid username is supplied but an invalid password/credential is supplied. If this error is received, it will prevent most other errors from being displayed. |
530 | Not permitted to logon at this time | Returned when a valid username and password/credential are supplied during times when login is restricted. |
531 | Not permitted to logon from this workstation | Returned when a valid username and password/credential are supplied, but the user is restriced from using the workstation where the login was attempted. |
532 | Password expired | Returned when a valid username is supplied, and the supplied password is valid but expired. |
533 | Account disabled | Returned when a valid username and password/credential are supplied but the account has been disabled. |
701 | Account expired | Returned when a valid username and password/credential are supplied but the account has expired. |
773 | User must reset password | Returned when a valid username and password/credential are supplied, but the user must change their password immediately (before logging in for the first time, or after the password was reset by an administrator). |
775 | Account locked out | Returned when a valid username is supplied, but the account is locked out. Note that this error will be returned regardless of whether or not the password is invalid. |
catch (Exception ex) { string extendError = ((System.DirectoryServices.DirectoryServicesCOMException)(ex)).ExtendedErrorMessage; if (extendError.Contains("data 773") || extendError.Contains("data 532")) { result = ADLoginResult.Success; } else { errMsg = ex.Message + "请联系管理员!"; } }
对上面的四种情况,得到的异常信息如下:
//下次登录必须修改密码 ,正确的密码
8009030C: LdapErr: DSID-0C0904DC, comment: AcceptSecurityContext error, data 773, v1db1
//下次登录必须修改密码 ,错误的密码
8009030C: LdapErr: DSID-0C0904DC, comment: AcceptSecurityContext error, data 52e, v1db1
//密码过期 ,正确的密码
8009030C: LdapErr: DSID-0C0904DC, comment: AcceptSecurityContext error, data 532, v1db1
//密码过期 ,错误的密码
8009030C: LdapErr: DSID-0C0904DC, comment: AcceptSecurityContext error, data 52e, v1db1
可以看出,当密码错误时,返回的错误信息中有data 52e的数据,可以依据异常信息中的这种差别来进行旧密码的校验。
参考:http://fwhyy.com/2015/09/csharp-operation-ad-to-modify-the-user-password/