fix(sts): keep "not found" in the LDAP auth failure so the console can log in root

Signed-off-by: Denis Babchuk <babchukdenis@icloud.com>

cmd/sts-handlers.go

@@ -101,7 +101,10 @@ const (
 )
 
 var (
-	errLDAPAuthenticationFailed   = errors.New("LDAP authentication failed")
+	// One message for unknown users and wrong passwords. The console tries
+	// the built-in login (root, access keys) only when the LDAP error says
+	// "not found", so the message keeps those words.
+	errLDAPAuthenticationFailed   = errors.New("LDAP authentication failed: user not found or invalid password")
 	globalSTSLDAPLoginRateLimiter = newSTSLDAPLoginRateLimiter(time.Minute/time.Duration(stsLDAPLoginBurst), stsLDAPLoginBurst, stsLDAPLoginEntryTTL)
 )
 

cmd/sts-handlers_test.go

@@ -2048,6 +2048,17 @@ func TestLDAPBindErrorToSTS(t *testing.T) {
 	}
 }
 
+// The console falls back from LDAP to the built-in identity provider (root,
+// access keys) only when the LDAP STS error says "not found"
+// (pgsty/silo-console api/client.go, NewConsoleCredentials). The uniform
+// failure for unknown users and wrong passwords must keep those words.
+func TestLDAPAuthFailureKeepsConsoleFallback(t *testing.T) {
+	_, err := ldapBindErrorToSTS(matchingAuthError{})
+	if err == nil || !strings.Contains(strings.ToLower(err.Error()), "not found") {
+		t.Fatalf("the console would not try the built-in login after %q", err)
+	}
+}
+
 func TestSTSLDAPLoginRateLimiterCleanup(t *testing.T) {
 	set := newSTSLDAPLoginKeyLimiterSet(time.Hour, 1, time.Minute)
 	start := time.Unix(0, 0)