The redirection URL for failed organization-based authentication is determined by checking the following places in the following order:
A URL set by the authentication module.
A URL set by a gotoOnFail Login URL parameter.
A URL set in the clientType custom files for the iplanet-am-user-failure-url attribute of the user’s entry ( amUser.xml).
A URL set in the clientType custom files for the iplanet-am-auth-login-failure-url attribute of the user’s role entry.
A URL set in the clientType custom files for the iplanet-am-auth-login-failure-url attribute of the user’s organization entry.
A URL set in the clientType custom files for the iplanet-am-auth-login-failure-url attribute as a global default.
A URL set for the iplanet-am-user-failure-url attribute in the user’s entry (amUser.xml).
A URL set for the iplanet-am-auth-login-failure-url attribute of the user’s role entry.
A URL set for the iplanet-am-auth-login-failure-url attribute of the user’s organization entry.
A URL set for the iplanet-am-auth-login-failure-url attribute as the global default.