Question on response status codes on auth failure

[Peter Schober]

* Stefan Santesson <stefan at aaa-sec.com> [2015-06-23 12:41]:
> Of course, except for the two conditions that I have no control over.
> 
> 1) The user hit the ³cancel button²

The default login page doesn't have such a button, IIRC.
My own certainly doesn't.

> 2) The user enters wrong credentials/PIN/password or user does not exisit.

If we sent people "back" to the SP with a SAML error code, instead of
letting them try again without that typo they put into the username or
password form field, they'd be storming the IT offices with torches, I
would imagine.
-peter