<html><head></head><body><div style="color:#000; background-color:#fff; font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;font-size:16px"><div id="yui_3_16_0_ym19_1_1463566547426_6288">Hi, Scott,</div><div id="yui_3_16_0_ym19_1_1463566547426_6204"><br></div><div dir="ltr" id="yui_3_16_0_ym19_1_1463566547426_6205">Thanks a lot for the pointers. I found the system/conf/utilities.xml for this. Another question is that when I tried to return some predefined status code in errors.xml such as AccountError, SessionNotFound,etc, I got exception like this.<br></div><div id="yui_3_16_0_ym19_1_1463566547426_6416"><br></div><div id="yui_3_16_0_ym19_1_1463566547426_6415">#################################<br></div><div id="yui_3_16_0_ym19_1_1463566547426_6411">A software error was encountered that prevents normal operation:</div><br id="yui_3_16_0_ym19_1_1463566547426_6412"> <div id="yui_3_16_0_ym19_1_1463566547426_6413" dir="ltr"><strong id="yui_3_16_0_ym19_1_1463566547426_6414">java.lang.IllegalArgumentException:
Cannot find state with id 'AccountError' in flow 'authn' -- Known state
ids are 'array<String>['AuthenticationSetup', 'TestForSession',
'SessionExists', 'FilterFlows', 'SelectAuthenticationFlow',
'CallAuthenticationFlow', 'CallSubjectCanonicalization',
'DetectIdentitySwitch', 'HandleIdentitySwitch',
'FinalizeAuthentication', 'UpdateSessionWithAuthenticationResult',
'proceed', 'AuthenticationException', 'IdentitySwitch',
'InputOutputError', 'InvalidCredentials', 'InvalidProfileContext',
'InvalidSubjectContext', 'InvalidSubjectCanonicalizationContext',
'NoCredentials', 'NoPassive', 'NoPotentialFlow', 'RequestUnsupported',
'ReselectFlow', 'RuntimeException', 'SubjectCanonicalizationError',
'LogRuntimeException']'</strong></div><div id="yui_3_16_0_ym19_1_1463566547426_6523" dir="ltr"><br></div><div id="yui_3_16_0_ym19_1_1463566547426_7043" dir="ltr">##################################</div><div id="yui_3_16_0_ym19_1_1463566547426_7044" dir="ltr"><br><strong id="yui_3_16_0_ym19_1_1463566547426_6414"></strong></div><div id="yui_3_16_0_ym19_1_1463566547426_6524" dir="ltr"><strong></strong>It seems to me there is a predefined subset of the keys in errors.xml map software allowed for authn flow. I looked at the class AuthnEventIds. It has a hard-coded list of ids, but that list is not the same as the list shown in the above exception. So is there a configuration file for this list that allow me to add AccountError and SessionNotFound so that I can return these ids in my flow?</div><div id="yui_3_16_0_ym19_1_1463566547426_6969" dir="ltr"><br></div><div id="yui_3_16_0_ym19_1_1463566547426_6970" dir="ltr">Thanks, Joey<br><strong id="yui_3_16_0_ym19_1_1463566547426_6414"></strong></div><div id="yui_3_16_0_ym19_1_1463566547426_6171"><span></span></div> <div class="qtdSeparateBR"><br><br></div><div style="display: block;" class="yahoo_quoted"> <div style="font-family: HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif; font-size: 16px;"> <div style="font-family: HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif; font-size: 16px;"> <div dir="ltr"><font face="Arial" size="2"> On Tuesday, May 17, 2016 11:28 AM, "Cantor, Scott" <cantor.2@osu.edu> wrote:<br></font></div> <br><br> <div class="y_msg_container">On 5/17/16, 10:13 AM, "dev on behalf of Joey Wang" <<a shape="rect" ymailto="mailto:dev-bounces@shibboleth.net" href="mailto:dev-bounces@shibboleth.net">dev-bounces@shibboleth.net</a> on behalf of <a shape="rect" ymailto="mailto:carbon_60@yahoo.com" href="mailto:carbon_60@yahoo.com">carbon_60@yahoo.com</a>> wrote:<br clear="none"><br clear="none"><br clear="none"><br clear="none">>The errors.xml file seems to only control the sub-status code:<br clear="none"><br clear="none">No, it controls the entire value.<br clear="none"><br clear="none">>The sub-status code urn:oasis:names:tc:SAML:2.0:status:AuthnFailed is configurable in errors.xml, but I could not find the status code (urn:oasis:names:tc:SAML:2.0:status:Requester) mapping in errors.xml.<br clear="none"><br clear="none">The bean "shibboleth.SAML2Status.AuthnFailed" is defined in a system file:<br clear="none"><br clear="none"><util:list id="shibboleth.SAML2Status.AuthnFailed"><br clear="none"><util:constant static-field="org.opensaml.saml.saml2.core.StatusCode.REQUESTER" /><br clear="none"><util:constant static-field="org.opensaml.saml.saml2.core.StatusCode.AUTHN_FAILED" /><br clear="none"> </util:list><br clear="none"><br clear="none">If you want something different you define your own bean (that's not in a system file) and point the event at it instead.<br clear="none"><br clear="none"><br clear="none">To be clear, nobody cares about those codes. No SAML software I've ever seen does anything with them. Error handling is universally bad in SAML impls, mine included, but making them better probably will never involve status codes. The details are just too vague and security posture necessitates hiding most of the real information anyway.<div class="yqt4901523368" id="yqtfd77542"><br clear="none"><br clear="none">-- Scott<br clear="none"><br clear="none">-- <br clear="none">To unsubscribe from this list send an email to <a shape="rect" ymailto="mailto:dev-unsubscribe@shibboleth.net" href="mailto:dev-unsubscribe@shibboleth.net">dev-unsubscribe@shibboleth.net</a><br clear="none"></div><br><br></div> </div> </div> </div></div></body></html>