The status code of the Response was not Success, was Responder -> Error occurred

[Cantor, Scott]

On 3/27/19, 1:32 PM, "users on behalf of Jason Kaye" <users-bounces at shibboleth.net on behalf of jakaye at syr.edu> wrote:

> Thanks for the help. I took "Incoming RequestedAuthnContext disallowed by profile configuration" to mean something
> in the IdP's profile was keeping  it from accessing the RequestedAuthnContext.

The setting disallowing it means to disallow requests that contain a RequestedAuthnContext element. It is in the IdP's SAML 2.0 SSO profile configuration bean for the relevant or default relying party configuration in use.

> We deal with multiple IdPs and this is in no way different from our implementations with them, so I am not sure why
> this is coming up here. I'm not sure what configuration setting would even set that.

The disallowedFeatures property. It is not set by default, thus somebody, be it you or otherwise, chose to set it.

As Peter said, what you're doing is pathological to start with. It is a bug in virtually all cases to *require* password authentication. Never do that. Not unless you are trying to disallow IP address authentication or some other odd case.

-- Scott