Is it possible to return a custom error for a logon trigger? I'm trying to get a logon trigger to return a custom error.  Thus far everything I have tried causes it to return the standard error:



My trigger looks like this:

CREATE TRIGGER Test_Logon_Trigger
ON ALL SERVER 
FOR LOGON
AS
BEGIN

IF ORIGINAL_LOGIN()= 'login_test' 
    BEGIN
        raiserror('Custom Error',25,16) 
        --PRINT 'Print'
        --ROLLBACK;
    END
END;


I have tried printing an error message and using a RAISERROR command separately and in combination.  I've also tried using the WITH NOWAIT clause on RAISERROR.  In all cases it just sends the message to the error log.  Does anyone know how to modify the error being returned displayed on the screen?  I'm even ok with returning a second error if necessary.
This behaviour is a security feature to make hacking more difficult, specifically because there is no variation in the output depending on the input. (Aside from exposing the fact there is a logon trigger active.)

If a password is mistyped, the system doesn't respond with an error saying "the password is wrong" or even whether the login name specified exists. If it told you why, this makes penetrating the system much easier because there's less guesswork involved.

So really if there is a way to do this using built-ins, I would have no hesitation to report it as a bug.

That of course doesn't solve what you're trying to do, which, IMO, is questionable for the same reasons.

Since login failures should be rare, what I would suggest is that all the restrictions be published internally in a predictable location (e.g., SharePoint). The main things with this are to make sure the list stays up-to-date (it could be data-driven), and also that it's visible to everyone who has access to the server (as opposed to everyone who is able to attempt to connect to the server, which is very different).