passive auth and login handlers

[Cantor, Scott E.]

On 8/11/11 3:10 PM, "Paul Hethmon" <paul.hethmon at clareitysecurity.com>
wrote:
>14:54:31.459 - ERROR
>[edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:517]
>- [http-172.16.14.246-16380-1:] - Authentication failed with the error:
>edu.internet2.middleware.shibboleth.idp.authn.AuthenticationException:
>Passive authentication not supported without a previous session.

This log message gets sent out right before it returns control to the
profile handler. That's supposed to pick it up and send back a SAML error
(or whatever the profile decides to do).

>Now, everything seems to work ok, but I feel I must be missing something
>in how I convey the reason for the failure to Shib. I'm seeing the error
>message in the appropriate attribute and thats what the
>AuthenticationEngine keys on to throw the exception.
>
>So, am I doing this right?

I think so.

-- Scott