Enum AuthenticationError 

pub enum AuthenticationError {
    EmptyPassword,
    EmptyUsername,
    NoSuchUser,
    InvalidPassword,
    Ambiguous {
        matched: usize,
    },
    AccountUnusable {
        reason: AccountProblem,
        diagnostic: String,
    },
    Unreachable(Error),
    ServiceAccount(Error),
    Directory(LdapResult),
}

Why an authentication attempt did not succeed.

Every variant is distinguishable so that a log can say what happened. Not every variant may be shown to the person logging in — see AuthenticationError::is_credential_failure.

Variants

EmptyPassword

The password field was empty.

Its own variant rather than an InvalidPassword, because this one never touched the network: LDAP would have answered it with success, and this is the client refusing to ask.

EmptyUsername

The username field was empty, or held a NUL.

NoSuchUser

The search found nobody.

InvalidPassword

The entry exists and the password is wrong.

Ambiguous

More than one entry has that username. Refused rather than resolved: picking one means picking somebody arbitrary to log in as.

Fields

matched: usize

AccountUnusable

The password may well be right, but a policy says no.

Fields

reason: AccountProblem

diagnostic: String

Unreachable(Error)

The directory could not be reached, or the connection failed part way.

ServiceAccount(Error)

The client’s own service account could not bind. Not the user’s problem, and worth paging somebody about.

Directory(LdapResult)

The directory refused for a reason this package does not model.

Implementations

impl AuthenticationError

pub fn is_credential_failure(&self) -> bool

Whether this is “the credentials were wrong” in any of its forms.

Show one identical message for every case where this is true. A form that distinguishes “no such user” from “wrong password” tells an attacker which usernames are real, one guess at a time — and it does it for free, at any rate they like.

Everything this returns false for is an operational problem, and saying “we could not reach the directory” for those is both honest and safe.

pub fn is_directory_failure(&self) -> bool

Whether the directory itself is at fault rather than the credentials.

Trait Implementations

impl Debug for AuthenticationError

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Display for AuthenticationError

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Error for AuthenticationError

fn source(&self) -> Option<&(dyn Error + 'static)>

Returns the lower-level source of this error, if any.

fn description(&self) -> &str

👎Deprecated since 1.42.0:

use the Display impl or to_string()

fn cause(&self) -> Option<&dyn Error>

👎Deprecated since 1.33.0:

replaced by Error::source, which can support downcasting

fn provide<'a>(&'a self, request: &mut Request<'a>)

🔬This is a nightly-only experimental API. (error_generic_member_access)

Provides type-based access to context intended for error reports.

impl From<AuthenticationError> for Error

fn from(error: AuthenticationError) -> Error

Converts to this type from the input type.