Initiating an error?

[Peter Schober]

* Jan Vilhuber <JVilhuber at absolute.com> [2017-09-15 09:54]:
> I use sessionhook in shibboleth SP to do some application setup. Should something go wrong, I want 2 things:
> 1) we need to clear the shibboleth SP session (don't want to leave the user in an authenticated state if authorization failed)
> 2) A customized error needs to be presented to the user giving information about what went wrong.

Both things are possible using either the AttributeChecker handler or
a custom sessionHook.
For 1 the AttributeChecker handler has the flushSession="true" setting.
For 2 you'd adapt the filename and/or content of the template to render.

With a custom sessionHook to clear the Shib SP session you could
simply remove all the HTTP Cookies set by the SP (implementation
detail, so names might change; though I think you can set/fix the
cookie names yourself, if desired), or even simpler remove/expire all
HTTP Cookies the HTTP User Agent sent to you. It's your own code, you
can do whatever you want.
And of course you can render any file/template/content you want from
your own sessionHook code as well.

-peter