Can we get back user from IDP if user fails to enter valid credentials?

[Cantor, Scott]

On 4/13/12 10:38 AM, "Pravin Kulkarni" <pravin.kulkarni at fasttrackteam.com>
wrote:

>I am working for a SP. The SP redirects users to IDP to authenticate. If
>user successfully enters credentials, gets back to SP and if fails to
>enter valid credentials, gets stuck on the IDP website and does not get
>back to SP.
> 
>Is there a way to get the user back on SP website if user does not
>perform any activity on the IDP website for some specified time OR fails
>to enter valid credentials in 3 attempts?

Some conditions are supposed to result in the SP gaining control back, and
the profile is biased towards trying to do that. But there's no way to do
that if the failure happens during authentication itself in general.

And IdPs tend to frankly frown on returning errors to SPs because,
honestly, they tend to do a terrible job of handling them (and in
fairness, the Shibboleth SP doesn't have a good way to make error handling
work well either).

-- Scott