How to insert detailed message in saml response

[ayeletgini]

Hi Joey,
First of all thank you for your detailed answer :)
I digged in it a lot before posting this message in the forum, even debugged shibboleth in order to understand what is going on in the password flow.
The password flow is the one that I am using. And from what I see in shibboleth's code the validation on ldap (which yes this is what I am using), does throw an event named by InvalidCredentials.
And the invalid credentials event does have a key in errors.xml. so I don't think the problem is to identify the event but rather that instead of writing the error to the response, it will try to move to the next authn flow and then write the "no potentials flow" as a final error to the response.

By the way - My Client is actually not an end user but a non-web client, some kind of agent which will authenticate to the system. So actually I am not using the web flows but I am using the ECP flows.
Did you had your experience with web or non-web?

Thanks!

Ayelet.

From: Joey Wang [via Shibboleth] [mailto:ml-node+s1660669n7626609h47 at n2.nabble.com]
Sent: Thursday, July 07, 2016 5:21 PM
To: Ginni, Ayelet <ayelet at hpe.com>
Subject: Re: How to insert detailed message in saml response

Hi, Ayelet,

I had a similar experience as the client needs more detailed error information from IDP. I was able to address it to some degree with helps from Scott. Not sure if my approach is right or wrong, but I can share my experience with you to see if it helps you.

First of all, Scott is correct in saying that if the end-user cannot do anything to the specific error messages anyway, there is no need to trouble yourself with it. In my case, I am developing a clinical system that SP needs the detailed messages for auditing purpose as required by law.

Now, it looks like you are using LDAP authentication in your case. Are you writing your own authn flow? If you are not, you may not be able to trap the LDAP errors because the default authn flow you are using may not do that for you. So if you want those messages to be included in your SAML response, first thing you need to do is to write your own authn flow to generate appropriate events based on the LDAP error messages.

Second, there are some predefined events and keys in the errors.xml file. If your LDAP errors can not be mapped to a predefined key, you can define your own events and keys. You can add new events in authn-events-flow.xml file and define the keys in the errors.xml for those events.

Third, you can then modify error-messages.properties file to provide detailed description of the errors.

Joey


On Wednesday, July 6, 2016 9:06 AM, "Cantor, Scott" <[hidden email]</user/SendEmail.jtp?type=node&node=7626609&i=0>> wrote:

> it actually means that somehow the authentication flow mechanism fallback
> should be disabled.

In effect, yes. It's simply how the system was designed to work and the error handling was never very important since any non-SOAP cases involve error pages that have the ability to dig inside the AuthenticationContext if they care about specific exceptions recorded.

> but even if i tried to do it (commented the transition to "ReselectFlow" (at
> system\flows\authn\authn-abstract-flow.xml), i still don't get the invalid
> credentials message in saml response. i am getting something else such as
> "unexpected" message with the event of "InvalidSubjectCanonicalization" or
> something like that. maybe it's a good start (?)

That means you broke the flow I would imagine, and just didn't change things in a reasonable way.

> Anyway i wonder why it is not supported in ECP flow, because on UI i can see
> different errors which indicates on different login errors. so how come it
> is not something which we can get in ECP?

You don't see that in the IdP's UI, you see it in the Password login flow, which is self-contained and loops endlessly inside itself waiting for a successful result.

The fact that ECP works at all with no additional configuration is a miracle and only works if the client volunteers credentials. Error handling was the least of my concerns getting it to work.

It also strikes me as irrelevant. It matters to a help desk that an account is locked or whatever, and they should see that information themselves. Either way the user has to contact the same people and get the account reset. I think we generally give users no help by telling them information they can't act on anyway.

-- Scott

--
To unsubscribe from this list send an email to dev-unsubscribe at ...


--
To unsubscribe from this list send an email to [hidden email]</user/SendEmail.jtp?type=node&node=7626609&i=1>
________________________________
If you reply to this email, your message will be added to the discussion below:
http://shibboleth.1660669.n2.nabble.com/How-to-insert-detailed-message-in-saml-response-tp7626525p7626609.html
To unsubscribe from How to insert detailed message in saml response, click here<http://shibboleth.1660669.n2.nabble.com/template/NamlServlet.jtp?macro=unsubscribe_by_code&node=7626525&code=YXllbGV0QGhwZS5jb218NzYyNjUyNXwxNzEzNDk2ODMw>.
NAML<http://shibboleth.1660669.n2.nabble.com/template/NamlServlet.jtp?macro=macro_viewer&id=instant_html%21nabble%3Aemail.naml&base=nabble.naml.namespaces.BasicNamespace-nabble.view.web.template.NabbleNamespace-nabble.view.web.template.NodeNamespace&breadcrumbs=notify_subscribers%21nabble%3Aemail.naml-instant_emails%21nabble%3Aemail.naml-send_instant_email%21nabble%3Aemail.naml>




--
View this message in context: http://shibboleth.1660669.n2.nabble.com/How-to-insert-detailed-message-in-saml-response-tp7626525p7626611.html
Sent from the Shibboleth - Developers mailing list archive at Nabble.com.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20160707/4ca5355f/attachment-0001.html>