Return 401 on expired/missing session?

[Cantor, Scott]

> Is there an easy way to have mod_shib (or httpd) return, say, HTTP 401
> instead of a redirect to the IDP (or SAMLDS) in case where no valid session
> exists?

That's been left to the passive session feature, which leaves it up to the application. A passive session plus a static require rule would generally return a 403. That could probably be made more configurable as a response code vs. trying to bastardize what the requireSession feature does.

-- Scott