How to generate event in authn flow to map to SAML status

[Joey Wang]

Hi, Scott,
Thanks a lot for the pointers. I found the system/conf/utilities.xml for this. Another question is that when I tried to return some predefined status code in errors.xml such as AccountError, SessionNotFound,etc, I got exception like this.

#################################
A software error was encountered that prevents normal operation:
 java.lang.IllegalArgumentException: Cannot find state with id 'AccountError' in flow 'authn' -- Known state ids are 'array<String>['AuthenticationSetup', 'TestForSession', 'SessionExists', 'FilterFlows', 'SelectAuthenticationFlow', 'CallAuthenticationFlow', 'CallSubjectCanonicalization', 'DetectIdentitySwitch', 'HandleIdentitySwitch', 'FinalizeAuthentication', 'UpdateSessionWithAuthenticationResult', 'proceed', 'AuthenticationException', 'IdentitySwitch', 'InputOutputError', 'InvalidCredentials', 'InvalidProfileContext', 'InvalidSubjectContext', 'InvalidSubjectCanonicalizationContext', 'NoCredentials', 'NoPassive', 'NoPotentialFlow', 'RequestUnsupported', 'ReselectFlow', 'RuntimeException', 'SubjectCanonicalizationError', 'LogRuntimeException']'
##################################
It seems to me there is a predefined subset of the keys in errors.xml map software allowed for authn flow. I looked at the class AuthnEventIds. It has a hard-coded list of ids, but that list is not the same as the list shown in the above exception. So is there a configuration file for this list that allow me to add AccountError and SessionNotFound so that I can return these ids in my flow?
Thanks, Joey
 

    On Tuesday, May 17, 2016 11:28 AM, "Cantor, Scott" <cantor.2 at osu.edu> wrote:
 

 On 5/17/16, 10:13 AM, "dev on behalf of Joey Wang" <dev-bounces at shibboleth.net on behalf of carbon_60 at yahoo.com> wrote:



>The errors.xml file seems to only control the sub-status code:

No, it controls the entire value.

>The sub-status code urn:oasis:names:tc:SAML:2.0:status:AuthnFailed is configurable in errors.xml, but I could not find the status code (urn:oasis:names:tc:SAML:2.0:status:Requester) mapping in errors.xml.

The bean "shibboleth.SAML2Status.AuthnFailed" is defined in a system file:

<util:list id="shibboleth.SAML2Status.AuthnFailed">
<util:constant static-field="org.opensaml.saml.saml2.core.StatusCode.REQUESTER" />
<util:constant static-field="org.opensaml.saml.saml2.core.StatusCode.AUTHN_FAILED" />
    </util:list>

If you want something different you define your own bean (that's not in a system file) and point the event at it instead.


To be clear, nobody cares about those codes. No SAML software I've ever seen does anything with them. Error handling is universally bad in SAML impls, mine included, but making them better probably will never involve status codes. The details are just too vague and security posture necessitates hiding most of the real information anyway.

-- Scott

-- 
To unsubscribe from this list send an email to dev-unsubscribe at shibboleth.net


  
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20160518/b199bc23/attachment.html>