LDAP/AD - How to determine whether user name or password is mismatch

Question

In my application, I am using LDAP bind authentication mechanism. I am getting AuthenticationException commonly even if any one is mismatch(user name or password).
I want to show error message either User Name is mismatch or Password mismatch. Currently, Using AuthenticationException not able to get the proper details.

Is there any existing API will help? or need to query using API?

Thanks in Advance.

Answer 1

If users give username and password for authentication, it's best practice not to tell them the exact reason why a log on wasn't successful. You always tell them there's a mismatch between username and password, so an attacker doesn't learn if a particular username exists.

Answer 2

I agree that the best practice is not to tell the reason.

--

But if you have to do it no matter what:

Do a search with the Username to check if the Username exists. If it doesn't exist it's an error.

If user exists and it continues to authenticate but you get AuthenticationException then it's a wrong password.

--

Edit:

If(checkUserExists(username)){
    //construct the hashtable environment
    //...
    ht.put(Context.SECURITY_PRINCIPAL, username); 
    ht.put(Context.SECURITY_PRINCIPAL, password); 
    //...
    try {
        localLdapContent = new InitialLdapContext(ht, null);
    } catch (Exception e) {
        //suppose it's a wrong password
    }
}else{
    //error user doesn't exist
}

You need another ldap connection with the permission to check user for all requests.

boolean checkUserExists(String username) {
    //...
    ht_administrator.put(Context.SECURITY_PRINCIPAL, admin_username); 
    ht_administrator.put(Context.SECURITY_PRINCIPAL, admin_password); 
    //...
    adminconn = new InitialLdapContext(ht_administrator, null);
    return adminconn.search(
        "uid="+username+",ou=people,dc=example,dc=com", "(objectclass=*)", searchControls
    ).hasMore();
}

Answer 3

The returned error codes from Microsoft Active Directory provide that information.

"The exception is [LDAP: error code 49 - 80090308: LdapErr: DSID-0Cxxxxxx, comment: AcceptSecurityContext error, data , vece ]."

The data values will inform of the issue.