Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is it possible to inform the user of slightly more than just "constraint violation" when they attempt to change their password?

Something like "password must be 7 or more characters", instead of leaving them guessing?


share|improve this question
Do you have the source code to whatever program is generating this "constraint violation" message? (It would help a lot if you told us what program that was.) – David Schwartz Aug 24 '12 at 13:01
My apologies, it's OpenDJ, and yes, I have the source if I need it. – Rory Aug 24 '12 at 13:06
So change the error message. ;) – David Schwartz Aug 24 '12 at 13:11

What is your LDAP server ?

Err 19, LDAP_CONSTRAINT_VIOLATION - Indicates that the attribute value specified in a modify, add, or modify DN operation violates constraints placed on the attribute. The constraint can be one of size or content (string only, no binary).

Most of the LDAP server already provide enough information about missing piece in password or attribute. Could you check 389 Directory server or RHDS. A sample from 389-ds is

[17/Aug/2012:22:24:59 +0000] conn=85 op=14 RESULT err=19 tag=103 nentries=0 etime=0
[17/Aug/2012:22:24:59 +0000] conn=85 op=14 MOD dn="uid=redhat,ou=Users,dc=example,dc=com", within password minimum age
share|improve this answer

You need to change the code to use the LDAP extended password modify request, which provides detailed error codes in its response.

share|improve this answer

It is not recommended to provide a more descriptive message. More descriptive text in an LDAP response would simply aid an attacker.

share|improve this answer
An attacker already knows the password he changes. What else to hide? – Dmitry Belyaev May 23 at 1:21

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.