[keycloak-user] password policy | federation to AD

[mj]

Hi,

REALM federated to active directory, with password requirements  like:
- required 1 uppercase
- required 1 digit
- required 1 lowercase
- required 1 special character
- min 8 characters
- cannot contain username
- max age 180 days

Now, when I logon keycloak, I am asked to change my password. Correct.

But when I provide a bad password like "123", I would expect keycloak to 
say something like: "ERROR: this password does not meet the password 
complexity requirements, please use ..." etc.

However, the only message I receive with a password like "xyz" is: 
"Could not modify attribute for DN 
[CN=username,CN=Users,DC=ad,DC=company,DC=com]"

So how is the user supposed to know what the configured password 
requirements are..?

This is on keycloak 3.1.0 btw.

Advise?

MJ