How to insert detailed message in saml response

[Cantor, Scott]

> it actually means that somehow the authentication flow mechanism fallback
> should be disabled.

In effect, yes. It's simply how the system was designed to work and the error handling was never very important since any non-SOAP cases involve error pages that have the ability to dig inside the AuthenticationContext if they care about specific exceptions recorded.

> but even if i tried to do it (commented the transition to "ReselectFlow" (at
> system\flows\authn\authn-abstract-flow.xml), i still don't get the invalid
> credentials message in saml response. i am getting something else such as
> "unexpected" message with the event of "InvalidSubjectCanonicalization" or
> something like that. maybe it's a good start (?)

That means you broke the flow I would imagine, and just didn't change things in a reasonable way.

> Anyway i wonder why it is not supported in ECP flow, because on UI i can see
> different errors which indicates on different login errors. so how come it
> is not something which we can get in ECP?

You don't see that in the IdP's UI, you see it in the Password login flow, which is self-contained and loops endlessly inside itself waiting for a successful result.

The fact that ECP works at all with no additional configuration is a miracle and only works if the client volunteers credentials. Error handling was the least of my concerns getting it to work.

It also strikes me as irrelevant. It matters to a help desk that an account is locked or whatever, and they should see that information themselves. Either way the user has to contact the same people and get the account reset. I think we generally give users no help by telling them information they can't act on anyway.

-- Scott