Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Is it possible to inform the user of slightly more than just "constraint violation" when they attempt to change their password?

Something like "password must be 7 or more characters", instead of leaving them guessing?

OpenDJ

share|improve this question
    
Do you have the source code to whatever program is generating this "constraint violation" message? (It would help a lot if you told us what program that was.) –  David Schwartz Aug 24 '12 at 13:01
    
My apologies, it's OpenDJ, and yes, I have the source if I need it. –  Rory Aug 24 '12 at 13:06
    
So change the error message. ;) –  David Schwartz Aug 24 '12 at 13:11

3 Answers 3

What is your LDAP server ?

Err 19, LDAP_CONSTRAINT_VIOLATION - Indicates that the attribute value specified in a modify, add, or modify DN operation violates constraints placed on the attribute. The constraint can be one of size or content (string only, no binary).

Most of the LDAP server already provide enough information about missing piece in password or attribute. Could you check 389 Directory server or RHDS. A sample from 389-ds is

[17/Aug/2012:22:24:59 +0000] conn=85 op=14 RESULT err=19 tag=103 nentries=0 etime=0
[17/Aug/2012:22:24:59 +0000] conn=85 op=14 MOD dn="uid=redhat,ou=Users,dc=example,dc=com", within password minimum age
share|improve this answer

You need to change the code to use the LDAP extended password modify request, which provides detailed error codes in its response.

share|improve this answer

It is not recommended to provide a more descriptive message. More descriptive text in an LDAP response would simply aid an attacker.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.