Access Control Rule in accessError template?

[Peter Schober]

* GEANT - Lukas Hämmerle <lukas.haemmerle at switch.ch> [2013-07-10 15:38]:
> As is written on
> https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPErrors an
> SP admin can use many parameters in the Shib error templates.
> 
> In case of an accessError (you see if you are forbidden access due to
> the access control rules) it is often not transparent to the user why he
> was not allowed access to a page. Of course the template could specify
> in prosa why access was denied. However, it could also be handy to be
> able to have (as a parameter) the actual access control rule which Shib
> used to determined if somebody gets access to a page or not.

Note that I do that all external to the templates, via the sessionHook.
Doing that portably in the SP's templating language had (still has?)
the problem of not supporting i18n and also the templates were quickly
turning into write-only code, e.g.:

<p><shibmlpif serviceName><shibmlp serviceName/></shibmlpif><shibmlpifnot serviceName>This
service</shibmlpifnot> requires information about you that your institution
<shibmlpif idp-name>
  <shibmlpif idp-infourl><a href="<shibmlp idp-infourl/>"><shibmlp idp-name /></a></shibmlpif>
  <shibmlpifnot idp-infourl><a href="<shibmlp idp-orgurl/>"><shibmlp idp-name /></a></shibmlpifnot>
</shibmlpif> did not provide.</p>

etc.

-peter