Index: phase3/extensions/CentralAuth/CentralAuthPlugin.php
===================================================================
--- phase3/extensions/CentralAuth/CentralAuthPlugin.php	(revision 48335)
+++ phase3/extensions/CentralAuth/CentralAuthPlugin.php	(working copy)
@@ -35,7 +35,7 @@
 	 * @return bool
 	 * @public
 	 */
-	function authenticate( $username, $password ) {
+	function authenticate( $username, $password, &$error=null ) {
 		global $wgCentralAuthAutoMigrate;
 
 		$central = new CentralAuthUser( $username );
@@ -45,7 +45,14 @@
 			return false;
 		}
 
-		$passwordMatch = $central->authenticate( $password ) == "ok";
+		$result = $central->authenticate( $password );
+		$passwordMatch = $result  == "ok";
+		
+		if ($result == 'locked') {
+			if ( !is_null( $error ) )
+				$error = wfMsg( 'centralauth-error-locked' );
+			return false;
+		}
 
 		if( $passwordMatch && $wgCentralAuthAutoMigrate ) {
 			// If the user passed in the global password, we can identify
Index: phase3/includes/AuthPlugin.php
===================================================================
--- phase3/includes/AuthPlugin.php	(revision 48246)
+++ phase3/includes/AuthPlugin.php	(working copy)
@@ -52,9 +52,10 @@
 	 *
 	 * @param $username String: username.
 	 * @param $password String: user password.
+	 * @param $error    String: string to put any errors in.
 	 * @return bool
 	 */
-	public function authenticate( $username, $password ) {
+	public function authenticate( $username, $password, &$error=null ) {
 		# Override this!
 		return false;
 	}
Index: phase3/includes/specials/SpecialUserlogin.php
===================================================================
--- phase3/includes/specials/SpecialUserlogin.php	(revision 48246)
+++ phase3/includes/specials/SpecialUserlogin.php	(working copy)
@@ -38,6 +38,7 @@
 	var $mName, $mPassword, $mRetype, $mReturnTo, $mCookieCheck, $mPosted;
 	var $mAction, $mCreateaccount, $mCreateaccountMail, $mMailmypassword;
 	var $mLoginattempt, $mRemember, $mEmail, $mDomain, $mLanguage, $mSkipCookieCheck;
+	var $mPluginError = '';
 
 	/**
 	 * Constructor
@@ -230,7 +231,11 @@
 		// create a local account and login as any domain user). We only need
 		// to check this for domains that aren't local.
 		if( 'local' != $this->mDomain && '' != $this->mDomain ) {
-			if( !$wgAuth->canCreateAccounts() && ( !$wgAuth->userExists( $this->mName ) || !$wgAuth->authenticate( $this->mName, $this->mPassword ) ) ) {
+			if( !$wgAuth->canCreateAccounts() &&
+					( !$wgAuth->userExists( $this->mName ) ||
+					!$wgAuth->authenticate( $this->mName, $this->mPassword )
+					)
+				) {
 				$this->mainLoginForm( wfMsg( 'wrongpassword' ) );
 				return false;
 			}
@@ -504,7 +509,7 @@
 			wfDebug( __METHOD__.": user does not exist\n" );
 			return self::NOT_EXISTS;
 		}
-		if ( !$wgAuth->authenticate( $user->getName(), $this->mPassword ) ) {
+		if ( !$wgAuth->authenticate( $user->getName(), $this->mPassword, &$this->mPluginError ) ) {
 			wfDebug( __METHOD__.": \$wgAuth->authenticate() returned false, aborting\n" );
 			return self::WRONG_PLUGIN_PASS;
 		}
@@ -556,7 +561,11 @@
 				$this->mainLoginForm( wfMsg( 'noname' ) );
 				break;
 			case self::WRONG_PLUGIN_PASS:
-				$this->mainLoginForm( wfMsg( 'wrongpassword' ) );
+				if ($this->mPluginError) {
+					$this->mainLoginForm( $this->mPluginError );
+				} else {
+					$this->mainLoginForm( wfMsg( 'wrongpassword' ) );
+				}
 				break;
 			case self::NOT_EXISTS:
 				if( $wgUser->isAllowed( 'createaccount' ) ){
Index: phase3/StartProfiler.php
===================================================================
--- phase3/StartProfiler.php	(revision 48246)
+++ phase3/StartProfiler.php	(working copy)
@@ -20,3 +20,6 @@
  */
 
 
+#require_once( dirname( __FILE__ ).'/includes/ProfilerSimpleText.php' );
+#$wgProfiler = new ProfilerSimpleText;
+
Index: extensions/CentralAuth/CentralAuthPlugin.php
===================================================================
--- extensions/CentralAuth/CentralAuthPlugin.php	(revision 48335)
+++ extensions/CentralAuth/CentralAuthPlugin.php	(working copy)
@@ -35,7 +35,7 @@
 	 * @return bool
 	 * @public
 	 */
-	function authenticate( $username, $password ) {
+	function authenticate( $username, $password, &$error=null ) {
 		global $wgCentralAuthAutoMigrate;
 
 		$central = new CentralAuthUser( $username );
@@ -45,7 +45,14 @@
 			return false;
 		}
 
-		$passwordMatch = $central->authenticate( $password ) == "ok";
+		$result = $central->authenticate( $password );
+		$passwordMatch = $result  == "ok";
+		
+		if ($result == 'locked') {
+			if ( !is_null( $error ) )
+				$error = wfMsg( 'centralauth-error-locked' );
+			return false;
+		}
 
 		if( $passwordMatch && $wgCentralAuthAutoMigrate ) {
 			// If the user passed in the global password, we can identify