Question on response status codes on auth failure

[Stefan Santesson]

Just to explain, we don’t just have the typical use case.

Our IdP also serves a signing service with extended capabilities to
support that scenario.
An opt out button = cancel, is a requirement the IdP must support among
other things.

We are not using the standard Shib UI. I use external authentication with
another UI adapted to our scenarios.

I can get rid of case 2 and just have the cancel option, but it must
generate an error back to the SP.
AuthnFaild works just fine.

/Stefan



On 23/06/15 15:50, "Cantor, Scott" <cantor.2 at osu.edu> wrote:

>> Of course, except for the two conditions that I have no control over.
>> 
>> 1) The user hit the ³cancel button²
>> 2) The user enters wrong credentials/PIN/password or user does not
>>exisit.
>
>As Peter said, the latter is not handled that way. The former isn't
>something the form does by default, but that's not inconceivable.
>
>> It is only these conditions that are of any interest and the SP wants to
>> be able to detect that this happened. To display appropriate information
>> to the user.
>
>There's no SAML status code for "canceled", so no standard way to signal
>that.
> 
>-- Scott
>