Initiating an error?

[Jan Vilhuber]

I use sessionhook in shibboleth SP to do some application setup. Should something go wrong, I want 2 things:
1) we need to clear the shibboleth SP session (don't want to leave the user in an authenticated state if authorization failed)
2) A customized error needs to be presented to the user giving information about what went wrong.

Similarly (related), I do session timeout in my app, and not in Shibboleth SP, so when the session times out I want basically the same as above: the SP session should be killed and I want a 'session timed out' message to be presented to the user.

I don't see how I can trigger either case from the application. I can certainly call the /Shibboleth.sso/Logout endpoint to kill the session, but I can't tell how I can provide a proper error to the user (and yes, I understand that in the SAML2-Logout behavior we may or may not come back to the SP, so in that case we may or may not be able to present an error anyway. Let's assume for this discussion that the IDP does indeed redirect back to the SP when it has processed the logout request).

Is there a way to do this? Any strategies or ideas? Yes, I've read about SLO and how it's ... difficult.

Jan