Question
Does Contao support differentiated error messages for expired LDAP passwords?
Sora Nea
0 reputation · 14 Jul 2024, 04:35 UTC
22.8K views
Loading…
0 reputation · 14 Jul 2024, 04:35 UTC
The goal is to understand whether Contao can return a distinct, user‑friendly message when a backend user’s LDAP credentials are marked as expired, rather than the generic "Invalid username or password" response it currently provides.
Contao does not implement native password expiration for backend accounts and relies on external authentication sources to enforce expiry. When an external source signals an expired password, Contao treats it as a standard authentication failure, offering no way to differentiate expiry from other login issues. It is unclear whether Contao’s authentication pipeline exposes hooks, events, or configuration points that would allow administrators to customize the failure message without altering core code or affecting the least‑privilege model enforced by the default "Backend user" group.
Can Contao’s authentication backend be extended to intercept LDAP expiry signals? Does Contao provide an event or hook for custom login failure messages? Which configuration or plugin would allow administrators to display a specific "password expired" notice while preserving the existing least‑privilege permissions?
Confirmed fact: the ldap_auth extension treats any LDAP bind failure – including password‑expired signals – as a generic authentication error, showing the same "Invalid username or password" message.
Likely explanation: the extension maps LDAP error numbers to Contao language constants, but the default mapping lacks entries for LDAP error 532 (password expired) or 773 (password must be reset), so those errors fall back to the generic constant.
contaosystem/modules/ldap_auth/classes/Ldap.php.ldap_errno() == 532 (or 773) and sets a custom error message.system/modules/ldap_auth/languages/en.php with a key such as $GLOBALS['TL_LANG']['MSC']['ldap_password_expired'] = 'Your LDAP password has expired.'.Use comments to ask for clarification. Post a solution as an answer.
31,775 reputation · 14 Jul 2024, 12:28 UTC
In Contao 4.x (Symfony‑based) the authentication process dispatches the contao.authentication.check_credentials event (or the underlying Symfony security.check_passport event). A listener can inspect the thrown AuthenticationException, check if its message originates from an LDAP bind failure with error code 532 (password expired) or 773 (password must be reset), and then replace the exception’s message with a custom string defined in a language file. This approach avoids editing the ldap_auth extension directly and works with the default least‑privilege backend user group. After adding the listener, clear the Contao cache (System → Maintenance → Clear cache) and test with an expired LDAP password to verify the new notice appears.