how would we suggest improving the user experience at this SP

[Scott Koranda]

On Wed, Jun 4, 2014 at 10:27 AM, Cantor, Scott <cantor.2 at osu.edu> wrote:
> On 6/4/14, 11:21 AM, "Peter Schober" <peter.schober at univie.ac.at> wrote:
>>
>>[ Slight tangent: I wonder if as an SP I should go one step further
>>and turn such error pages into HTML forms with one large, friendly
>>button saying "Get me access" that will notify the technical contact
>>given in SAML metadata for the IDP the subject used to authenticate,
>>providing all the detail s/he may need to act upon it (date, time,
>>client IP, attributes needed, attribtues [not] recieved). ]
>
> That was certainly where the original thinking was headed. One of the
> problems with that is that the technical contact is often not the right
> choice, and we were looking at using the administrative contact for that.
> Ultimately it seemed to me that the best option was to avoid email
> altogether and leave it up to the IdP by way of a URL that could do
> anything they wanted it to do, including initiate an email if that's the
> choice they want to make.
>

I cannot speak for other federations but InCommon does not require
IdPs to publish error URLs in the metadata.

My experience as an SP operator is that to handle the variety of
IdP metadata for these types of issues requires an error handling
page with a fair bit of logic to determine the specific action to take.

It would be helpful if federations required IdPs to include the errorURL.

I would also recommend that people who know IdP operators review
the errorURL that is published in the metadata and make suggestions--you
might be surprised by what your IdP errorURL page says or does not say.

Scott K