Accessing authentication response status code

[Cantor, Scott]

On 9/23/14, 11:45 AM, "Rob Commarota" <robcom99 at yahoo.com> wrote:

>Is there any way to access the authentication response status code
>outside of the error handling capabilities of Shibboleth?

Not without writing a plugin, there's no extractor for that particular
information. There's one for assertion fields, but not responses.

>Our IdP is returning status code such as:
>
>urn:securekey:names:tc:SAML:2.0:status:UserCancelled
>urn:securekey:names:tc:SAML:2.0:status:SystemUnavailable
>urn:securekey:names:tc:SAML:2.0:status:AuthnFailed

FYI, those are invalid unless securekey has registered a URN namespace
with IANA.

>We'd like to be able to interpret these in the application to provide
>some direction for the end user. I thought I might be able to treat the
>status codes as attributes, but they really aren't attributes, so I am
>not sure that makes sense.

The SP has plugins that turn various things into SP attributes, which are
not the same as SAML attributes, but not that particular field, mainly
because you have no session if the status is not Success. The error
handling page is the only place where non-successful status information
could ever be seen.

-- Scott