Customizing logon error messages

This configuration does apply to the whole access policy, so you'll have to get creative if you want the message to be different for different logon agents.

One way might be to use session variables. See how some of the message text boxes have stuff like %{session.whatever}? Those are APM session variables that you can write any data you want into. So write some text to a session variable right before your logon page agent, in a "variable assign", like this:

Then use that session variable in the text response customization, like this:

This way you can re-assign any text you like to that variable depending on your context.

so I interpreted your post as look at the session variables for a user after they put in an incorrect OTP response.

so I did a test,  logged in with PW correct,  then put in incorrect OTP response and then checked session variables.    I see session.logon.page.errorcode as 1000 and session.otp.verify.last.errmsg as OTP_Mismatch.

I have been looking throughout the advanced customization code and cannot find any references to error code 1000.      I also find no code relating to OTP_Mismatch.

I get the concept that you are mentioning here get the error, set it to something different via session variables and get a different result.     My problem here is that how would one know what error codes relate to?    If you go under basic customization,  there are error codes and the text associated with them.    The key thing is that the error codes are text and not number based,   there is no visible column which relates the text to a number.

I'm guessing that this forum is protected by a F5 and that if you put in your PW wrong,  you get one message,   if you then put in your OTP wrong you get another message.   So the results I am looking for have to be possible.       Is there a way to talk with the person(s) who setup the logon policy to understand how they got around having different error messages for each use case?

Ah ok great sleuthing, sounds like you found the variable that contains your error: session.otp.verify.last.errmsg

So, all you have to do is set the text to be "Invalid Login. OTP error: %{session.otp.verify.last.errmsg}", and then when APM displays the error to the user, it will be dynamically generated from the authentication agent.