Unable to catch LDAPException error code(53) in jsp on weblogic 6.1

Question

When I try to authenticate a user in LDAP whose account is inactivated the following error is thrown UNWILLING_TO_PERFORM in weblogic Server log.
My JSP file couldn't to catch this exception, where as it could catch all other exception like NO_SUCH_OBJECT
INVALID_CREDENTIALS. It throws 500 internal server error on browser which seems awkward to the user.
Im Using basic authentication model by setting 401 status code in response.
I have even tried catch block with Exception, but failed to catch it.
Could Any one plz help me out.
Exception in detail-----
Servlet failed with Exception
netscape.ldap.LDAPException: error result (53); Account inactivated. Contact system administrator.; DSA is unwilling to perform
at netscape.ldap.LDAPConnection.checkMsg(LDAPConnection.java:4852)
        at netscape.ldap.LDAPConnection.internalBind(LDAPConnection.java:1757)
        at netscape.ldap.LDAPConnection.authenticate(LDAPConnection.java:1294)
        at netscape.ldap.LDAPConnection.authenticate(LDAPConnection.java:1303)
        at netscape.ldap.LDAPConnection.bind(LDAPConnection.java:1613)
        at weblogic.security.ldaprealmv2.LDAPDelegate.authenticate(LDAPDelegate.java:851)
        at weblogic.security.ldaprealmv2.LDAPRealm.authUserPassword(LDAPRealm.java:61)
        at weblogic.security.acl.AbstractListableRealm.authInternal(AbstractListableRealm.java:186)
        at weblogic.security.acl.AbstractListableRealm.authenticate(AbstractListableRealm.java:127)
        at weblogic.security.acl.AbstractListableRealm.getUser(AbstractListableRealm.java:110)
        at weblogic.security.acl.CachingRealm.authenticate(CachingRealm.java:945)
        at weblogic.security.acl.CachingRealm.getUser(CachingRealm.java:889)
        at weblogic.security.acl.Realm.authenticate(Realm.java:200)
        at weblogic.security.acl.Realm.getAuthenticatedName(Realm.java:233)
        at weblogic.security.acl.internal.Security.authenticate(Security.java:172)
        at weblogic.servlet.security.internal.SecurityModule.checkAuthenticate(SecurityModule.java:302)
        at weblogic.servlet.security.ServletAuthentication.weak(ServletAuthentication.java:318)
        at weblogic.servlet.security.internal.BasicSecurityModule.checkAuthenticateHeader(BasicSecurityModule.java:62)
        at weblogic.servlet.security.internal.ServletSecurityManager.checkAccess(ServletSecurityManager.java:118)
        at weblogic.servlet.internal.WebAppServletContext.invokeServlet(WebAppServletContext.java:2674)
        at weblogic.servlet.internal.ServletRequestImpl.execute(ServletRequestImpl.java:2427)
        at weblogic.kernel.ExecuteThread.execute(ExecuteThread.java:159)
        at weblogic.kernel.ExecuteThread.run(ExecuteThread.java:140)
--------------- nested within: ------------------
weblogic.security.ldaprealmv2.LDAPRealmException: Account inactivated. Contact system administrator. - with nested exception:
[netscape.ldap.LDAPException: error result (53); Account inactivated. Contact system administrator.; DSA is unwilling to perform]
        at weblogic.security.ldaprealmv2.LDAPDelegate.authenticate(LDAPDelegate.java:885)
        at weblogic.security.ldaprealmv2.LDAPRealm.authUserPassword(LDAPRealm.java:61)
        at weblogic.security.acl.AbstractListableRealm.authInternal(AbstractListableRealm.java:186)
        at weblogic.security.acl.AbstractListableRealm.authenticate(AbstractListableRealm.java:127)
        at weblogic.security.acl.AbstractListableRealm.getUser(AbstractListableRealm.java:110)
        at weblogic.security.acl.CachingRealm.authenticate(CachingRealm.java:945)
        at weblogic.security.acl.CachingRealm.getUser(CachingRealm.java:889)
        at weblogic.security.acl.Realm.authenticate(Realm.java:200)
        at weblogic.security.acl.Realm.getAuthenticatedName(Realm.java:233)
        at weblogic.security.acl.internal.Security.authenticate(Security.java:172)
        at weblogic.servlet.security.internal.SecurityModule.checkAuthenticate(SecurityModule.java:302)
        at weblogic.servlet.security.ServletAuthentication.weak(ServletAuthentication.java:318)
        at weblogic.servlet.security.internal.BasicSecurityModule.checkAuthenticateHeader(BasicSecurityModule.java:62)
        at weblogic.servlet.security.internal.ServletSecurityManager.checkAccess(ServletSecurityManager.java:118)
        at weblogic.servlet.internal.WebAppServletContext.invokeServlet(WebAppServletContext.java:2674)
        at weblogic.servlet.internal.ServletRequestImpl.execute(ServletRequestImpl.java:2427)
        at weblogic.kernel.ExecuteThread.execute(ExecuteThread.java:159)
        at weblogic.kernel.ExecuteThread.run(ExecuteThread.java:140)
..so on

Answer 1

It would worth if you take a look to the access log file, and see what error code is returning your operation. I detected that when you perform an ldapsearch using a user with expired password (with DS 5.2, explicitly passwordExpirationTime set to 19700101000000Z in my case) the command returns "ldap_search: DSA is unwilling to perform"
jair@riscl~ $ ldapsearch -b "o=isp" -D "uid=RRJA2829,ou=people,o=affiliates,o=isp" -w met999 "uid=admin"
ldap_search: DSA is unwilling to perform
jair@riscl~ $ echo $?
53And the access log shows (LDAP_SUCCESS for BIND operation):
[23/Jun/2009:15:16:14 -0500] conn=1847 op=-1 msgId=-1 - fd=48 slot=48 LDAP connection from 127.0.0.1 to 127.0.0.1
[23/Jun/2009:15:16:14 -0500] conn=1847 op=0 msgId=1 - BIND dn="uid=RRJA2829,ou=people,o=affiliates,o=isp" method=128 version=3
[23/Jun/2009:15:16:14 -0500] conn=1847 op=0 msgId=1 - RESULT err=0 tag=97 nentries=0 etime=0 dn="uid=rrja2829,ou=people,o=affiliates,o=isp"
[23/Jun/2009:15:16:14 -0500] conn=1847 op=1 msgId=2 - need new password
[23/Jun/2009:15:16:14 -0500] conn=1847 op=1 msgId=2 - RESULT err=53 tag=101 nentries=0 etime=0
[23/Jun/2009:15:16:14 -0500] conn=1847 op=2 msgId=3 - UNBIND
[23/Jun/2009:15:16:14 -0500] conn=1847 op=2 msgId=-1 - closing - U1
[23/Jun/2009:15:16:15 -0500] conn=1847 op=-1 msgId=-1 - closed.So, it is possible that your code doesn't catch the exception because the bind operation is returning code 0 (LDAP_SUCCESS) and for some other reason weblogic is receiving a second code 53 which is thrown by the server and not catched by your code, I really don't know if it is possible, is just what comes to my mind right now.
I also made a test with java using the same user with expired password and couldn't catch any exception like in your case
import java.util.Hashtable;
import javax.naming.directory.*;*
*import javax.naming.ldap.*;
import javax.naming.*;
public class Password {
   public static void main (String args[]) {
      LdapContext ctx = null;
      String userid = "uid=RRJA2829,ou=people,o=affiliates,o=isp";
      String passwd = "met999";
      try {
         Hashtable env = new Hashtable();
         env.put("java.naming.factory.initial", "com.sun.jndi.ldap.LdapCtxFactory");
         env.put("java.naming.provider.url", "ldap://riscl:389/");
         env.put("java.naming.security.principal", userid);
         env.put("java.naming.security.credentials", passwd);
         ctx = new InitialLdapContext(env, null);
      } catch (AuthenticationException e) {
            System.out.println("=> "  +e.getMessage()+  " <=");
      } catch (NamingException ne) {
         System.out.println("=> "  +ne.getMessage()+  " <=");
}and the logs showed:
[23/Jun/2009:15:32:41 -0500] conn=43 op=-1 msgId=-1 - fd=52 slot=52 LDAP connection from 127.0.0.1 to 127.0.0.1
[23/Jun/2009:15:32:41 -0500] conn=43 op=0 msgId=1 - BIND dn="uid=RRJA2829,ou=people,o=affiliates,o=isp" method=128 version=3
[23/Jun/2009:15:32:41 -0500] conn=43 op=0 msgId=1 - RESULT err=0 tag=97 nentries=0 etime=0 dn="uid=rrja2829,ou=people,o=affiliates,o=isp"
[23/Jun/2009:15:32:42 -0500] conn=43 op=-1 msgId=-1 - closing - B1
[23/Jun/2009:15:32:42 -0500] conn=43 op=-1 msgId=-1 - closed.but in this case LDAP is not returning the code 53 "UNWILLING TO PERFORM" to java app in the way it did to ldapsearch.
Hope it helps.
BR,
jairsinho