passive auth and login handlers

[Cantor, Scott E.]

On 8/11/11 3:41 PM, "Paul Hethmon" <paul.hethmon at clareitysecurity.com>
wrote:
>I think what I'm looking for is a way to convey this in the Response:
>
>  <samlp:Status>
>    <samlp:StatusCode
>Value="urn:oasis:names:tc:SAML:2.0:status:Responder">
>      <samlp:StatusCode
>Value="urn:oasis:names:tc:SAML:2.0:status:NoPassive" />
>    </samlp:StatusCode>
>  </samlp:Status>

I thought that the profile handler handled that based on the exception
type, I'm not sure how to get it set from a custom handler. Good question.

>I don't see a way for my Login Handler to tell Shib to use the "NoPassive"
>failure code instead of the "AuthnFailed".

There might not be one.

>It's probably a bit pedantic on my part, as the relying party handles it
>fine now.

Well, Shibboleth wouldn't do what it's supposed to, it specifically looks
for the NoPassive code.

-- Scott