...
[14:10:45 CST(-0600)] <serac> Here we should probably be specific: warning and error.
[14:11:11 CST(-0600)] <serac> Warning is a case where auth succeeds but has information to present to user and error is failed auth that could be represented as exception.
[14:11:34 CST(-0600)] <serac> I'm really just advocating for calling it a warning in this case.
[14:11:50 CST(-0600)] <serac> Impending password expiration is a known use case.
[14:11:54 CST(-0600)] <serac> Dunno about others.