Question on response status codes on auth failure

[Stefan Santesson]

OK. I see.

I tested to change in errors.xml in shibboleth.SAML1StatusMappings to:

        <entry key="InvalidCredentials"
value-ref="shibboleth.SAML2Status.AuthnFailed" />



In the external Authn servlet I set:
    request.setAttribute(ReturnAttr.authnError.name(),
"InvalidCredentials²);


However, the IdP still responds with the same error codes (Requester and
then AuthnFailed).

Am I missing something, or should I just don¹t care?

/Stefan



On 22/06/15 16:55, "Cantor, Scott" <cantor.2 at osu.edu> wrote:

>> Why is it so?
>
>I spent less time thinking about it than I have writing this response.
>
>> The major status code seems to propose that there is an error on behalf
>>of
>> the requester, which clearly is not the case.
>
>There is no way for the IdP to know in most cases who is at fault, and I
>didn't analyze every case or create separate mappings for every possible
>condition.
>
>> Is it safe to reconfigure this, or can this create other problems?
>
>You can do anything you want. Returning any error to an SP is always
>likely to cause problems.
>
>-- Scott
>
>-- 
>To unsubscribe from this list send an email to
>users-unsubscribe at shibboleth.net