openldap怎么判断是连续输错密码次数过多导致被锁还是用户名密码错误？

Question

项目上的openldap配置了连续输错3次密码即锁定账户5秒,但是在输错3次以后在锁定期用正确的密码去openldap认证,发现返回的异常和密码错误的异常是一样的,都是 [LDAP: error code 49 - Invalid Credentials],怎么区分是账户被锁还是密码输入错误呢?

怎么区分是账户被锁还是密码输入错误呢?

异常代码authContext = new InitialLdapContext(env, controls);

String opDN = "cn=" + uid + "," + OP_LDAP_BASEDN;
        String queryDN = "cn=" + uid;
        Hashtable<String, String> env = new Hashtable<String, String>();
        env.put(Context.INITIAL_CONTEXT_FACTORY, CommonConstant.FACTORY);
        env.put(Context.PROVIDER_URL, ldapUrl + OP_LDAP_BASEDN);
        env.put(Context.SECURITY_AUTHENTICATION, CommonConstant.AUTHENTICATION);
        env.put(Context.SECURITY_CREDENTIALS, password);
        env.put(Context.SECURITY_PRINCIPAL, opDN);
        env.put("com.sun.jndi.ldapContext.connect.timeout", CommonConstant.TIMEOUT);
        try {
            authContext = new InitialLdapContext(env, controls);
        } catch (javax.naming.AuthenticationException e) {
            e.printStackTrace();
            logger.error("ldap认证异常{}", e.getMessage());
            isValid = false;
        } catch (NamingException e) {
            e.printStackTrace();
            logger.error("ldap认证异常{}", e.getMessage());
            isValid = false;
        }

异常堆栈

javax.naming.AuthenticationException: [LDAP: error code 49 - Invalid Credentials]
    at com.sun.jndi.ldap.LdapCtx.mapErrorCode(LdapCtx.java:3154)
    at com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:3100)
    at com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:2886)
    at com.sun.jndi.ldap.LdapCtx.connect(LdapCtx.java:2800)
    at com.sun.jndi.ldap.LdapCtx.<init>(LdapCtx.java:319)
    at com.sun.jndi.ldap.LdapCtxFactory.getUsingURL(LdapCtxFactory.java:192)
    at com.sun.jndi.ldap.LdapCtxFactory.getUsingURLs(LdapCtxFactory.java:210)
    at com.sun.jndi.ldap.LdapCtxFactory.getLdapCtxInstance(LdapCtxFactory.java:153)
    at com.sun.jndi.ldap.LdapCtxFactory.getInitialContext(LdapCtxFactory.java:83)
    at javax.naming.spi.NamingManager.getInitialContext(NamingManager.java:684)
    at javax.naming.InitialContext.getDefaultInitCtx(InitialContext.java:313)
    at javax.naming.InitialContext.init(InitialContext.java:244)
    at javax.naming.ldap.InitialLdapContext.<init>(InitialLdapContext.java:154)
    at com.cmcc.fcp.util.LdapUtil.authenticate(LdapUtil.java:102)
    at com.cmcc.fcp.controller.CustomAuthenticationHandler.seemsGood(CustomAuthenticationHandler.java:284)
    at com.cmcc.fcp.controller.CustomAuthenticationHandler.doAuthentication(CustomAuthenticationHandler.java:100)

怎么才能返回不同的异常用于区分?重点是我怎么区分这两种情况。

Answer 1

一般的，在error code 49的详细信息里，应该还有一个子code，类似下面：
LDAP: error code 49 - 80090308: LdapErr: DSID-0C0903A9, comment: AcceptSecurityContext error, data 701, v1db0

上面这个子code是701，每个值由不同含义，google上查一下可以得到：

Error Code	Description
525	user not found
52e	invalid credentials
530	not permitted to logon at this time
531	not permitted to logon at this workstation
532	password expired (remember to check the user set in osuser.xml also)
533	account disabled
701	account expired
773	user must reset password
775	user account locked

这样就可以区分是否lock了