How to insert detailed message in saml response

[Joey Wang]

Hi, Ayelet,
I had a similar experience as the client needs more detailed error information from IDP. I was able to address it to some degree with helps from Scott. Not sure if my approach is right or wrong, but I can share my experience with you to see if it helps you.
First of all, Scott is correct in saying that if the end-user cannot do anything to the specific error messages anyway, there is no need to trouble yourself with it. In my case, I am developing a clinical system that SP needs the detailed messages for auditing purpose as required by law.
Now, it looks like you are using LDAP authentication in your case. Are you writing your own authn flow? If you are not, you may not be able to trap the LDAP errors because the default authn flow you are using may not do that for you. So if you want those messages to be included in your SAML response, first thing you need to do is to write your own authn flow to generate appropriate events based on the LDAP error messages.
Second, there are some predefined events and keys in the errors.xml file. If your LDAP errors can not be mapped to a predefined key, you can define your own events and keys. You can add new events in authn-events-flow.xml file and define the keys in the errors.xml for those events.

Third, you can then modify error-messages.properties file to provide detailed description of the errors.
Joey

 

    On Wednesday, July 6, 2016 9:06 AM, "Cantor, Scott" <cantor.2 at osu.edu> wrote:
 

 > it actually means that somehow the authentication flow mechanism fallback
> should be disabled.

In effect, yes. It's simply how the system was designed to work and the error handling was never very important since any non-SOAP cases involve error pages that have the ability to dig inside the AuthenticationContext if they care about specific exceptions recorded.

> but even if i tried to do it (commented the transition to "ReselectFlow" (at
> system\flows\authn\authn-abstract-flow.xml), i still don't get the invalid
> credentials message in saml response. i am getting something else such as
> "unexpected" message with the event of "InvalidSubjectCanonicalization" or
> something like that. maybe it's a good start (?)

That means you broke the flow I would imagine, and just didn't change things in a reasonable way.

> Anyway i wonder why it is not supported in ECP flow, because on UI i can see
> different errors which indicates on different login errors. so how come it
> is not something which we can get in ECP?

You don't see that in the IdP's UI, you see it in the Password login flow, which is self-contained and loops endlessly inside itself waiting for a successful result.

The fact that ECP works at all with no additional configuration is a miracle and only works if the client volunteers credentials. Error handling was the least of my concerns getting it to work.

It also strikes me as irrelevant. It matters to a help desk that an account is locked or whatever, and they should see that information themselves. Either way the user has to contact the same people and get the account reset. I think we generally give users no help by telling them information they can't act on anyway.

-- Scott

-- 
To unsubscribe from this list send an email to dev-unsubscribe at shibboleth.net


   
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20160707/613da7be/attachment-0001.html>