How to generate event in authn flow to map to SAML status

[Cantor, Scott]

On 5/17/16, 10:13 AM, "dev on behalf of Joey Wang" <dev-bounces at shibboleth.net on behalf of carbon_60 at yahoo.com> wrote:



>The errors.xml file seems to only control the sub-status code:

No, it controls the entire value.

>The sub-status code urn:oasis:names:tc:SAML:2.0:status:AuthnFailed is configurable in errors.xml, but I could not find the status code (urn:oasis:names:tc:SAML:2.0:status:Requester) mapping in errors.xml.

The bean "shibboleth.SAML2Status.AuthnFailed" is defined in a system file:

<util:list id="shibboleth.SAML2Status.AuthnFailed">
<util:constant static-field="org.opensaml.saml.saml2.core.StatusCode.REQUESTER" />
<util:constant static-field="org.opensaml.saml.saml2.core.StatusCode.AUTHN_FAILED" />
    </util:list>

If you want something different you define your own bean (that's not in a system file) and point the event at it instead.


To be clear, nobody cares about those codes. No SAML software I've ever seen does anything with them. Error handling is universally bad in SAML impls, mine included, but making them better probably will never involve status codes. The details are just too vague and security posture necessitates hiding most of the real information anyway.

-- Scott