pub enum AccountProblem {
NoSuchAccount,
WrongPassword,
TimeRestricted,
WorkstationRestricted,
PasswordExpired,
Disabled,
Expired,
MustChangePassword,
Locked,
Unspecified,
}Expand description
Why a directory would not let an account in.
Variants§
NoSuchAccount
Active Directory’s data 525: the account does not exist. Surfaced as
AuthenticationError::NoSuchUser rather than kept here.
WrongPassword
data 52e: the password is wrong, and only the password.
TimeRestricted
data 530: not permitted to log on at this time of day.
WorkstationRestricted
data 531: not permitted to log on from this workstation.
PasswordExpired
data 532: the password has expired.
Disabled
data 533: the account is disabled.
Expired
data 701: the account itself has expired.
MustChangePassword
data 773: the user must change their password before logging in.
Locked
data 775: the account is locked out.
Unspecified
The directory refused without saying which of these it was.
Implementations§
Source§impl AccountProblem
impl AccountProblem
Sourcepub fn from_diagnostic(diagnostic: &str) -> Option<AccountProblem>
pub fn from_diagnostic(diagnostic: &str) -> Option<AccountProblem>
Read Active Directory’s hexadecimal sub-code out of a diagnostic.
AD answers every bind failure with invalidCredentials and puts the
real reason in a message shaped like
80090308: LdapErr: DSID-0C0903A9, comment: AcceptSecurityContext error, data 533, v2580. It is undocumented in any RFC and completely stable in
practice, and without it a help desk cannot tell a forgotten password
from a disabled account.
Anything that is not Active Directory returns None here, which is the
right answer: OpenLDAP means exactly what its result code says.