error handling

[Cantor, Scott]

On 8/22/19, 10:03 AM, "users on behalf of Guillaume Rousse" <users-bounces at shibboleth.net on behalf of guillaume.rousse at renater.fr> wrote:

> There is a perfect mapping between template names and error kinds, 
> excepted for the last ones: is the 'attrChecker.html' template meant to 
> be used in case of error from the 'access' kid, or is it unrelated ?

The checker is a sample for using the attribute checking handler to check attribute requirements, it's nothing to do with the old error handling machinery per se. Insufficient attributes are not an "error" to the SP.

Access errors are meant to be handled by the web server by customizing 403 handling and not the SP itself, so there's no example of using the SP to deal with them anymore but it's still possible to override the default by providing a template to use, in which case it won't return a 403 but will process the template. That's what the docs mean by "Path to a template to use for authorization failures. When omitted, a generic 403 status will be returned when possible."

> Does it means than all those error kinds have actual default values, not 
> just the two one mentionned, and than this current presentation is 
> misleading ?

The configuration reference on the page at the end enumerates all of the error attributes that control the template names it uses and all of the ones you're talking about are listed there.

-- Scott