Incorporating the error codes and their explanations found in errormap.inc into the access policy deny messages

The best way I have accomplished this in the past is to create multiple deny endings and customize the text on the ending to what the error message should be.

Instead of the default message of

Access was denied by the access policy. This may be due to a failure to meet access policy requirements.

If you are an administrator, please go to Access Policy >> Reports : All Sessions page and look 
up the session reference number displayed above.

You could update it to say

You failed to authenticate please contact the helpdesk if you forgot your password.

Will this work for you?

-Seth

This is one way but since there's about 100 different error codes and I have about 12 access policies, you can see that's a lot of deny endings. I was hoping to find a more dynamic solution. I thought about the possibility of using the session variables in the messages. Has anyone tried it? If so, how does it work for you?

This is one way but since there's about 100 different error codes and I have about 12 access policies, you can see that's a lot of deny endings. I was hoping to find a more dynamic solution. I thought about the possibility of using the session variables in the messages. Has anyone tried it? If so, how does it work for you?

Have a look at session.logon.page.errorcode. However it will just give you a code which may not be much more informative. You could however implement an iRule to lookup a message for the code, that is if they correlate to errormap.inc. Let me work up something and get back to you.

That'll be great Kevin!