Handle ldap.UNWILLING_TO_PERFORM more gracefully

ipa-python/ipaerror.py

@@ -152,3 +152,8 @@ CONNECTION_GSSAPI_CREDENTIALS = gen_error_code(
         CONNECTION_CATEGORY,
         0x0003,
         "GSSAPI Authorization error")
+
+CONNECTION_UNWILLING = gen_error_code(
+        CONNECTION_CATEGORY,
+        0x0004,
+        "Account inactivated. Server is unwilling to perform.")

ipa-server/xmlrpc-server/funcs.py

@@ -77,7 +77,10 @@ class IPAConnPool:
         conn = ipaserver.ipaldap.IPAdmin(host,port,None,None,None,debug)
 
         # This will bind the connection
-        conn.set_krbccache(krbccache, cprinc.name)
+        try:
+            conn.set_krbccache(krbccache, cprinc.name)
+        except ldap.UNWILLING_TO_PERFORM, e:
+            raise ipaerror.gen_exception(ipaerror.CONNECTION_UNWILLING)
 
         return conn