error seen by user when 'Rejecting replayed message ID'?

[Cantor, Scott]

On 1/2/20, 11:55 PM, "users on behalf of Paul Henson" <users-bounces at shibboleth.net on behalf of henson at signet.id> wrote:

> What would one expect to see in a browser as far as an error message
> when the idp thinks it has detected a replayed message and aborts the
> authentication?

The same page.

More usefully, you can determine (and control) all of this, it's not hardwired and it's not hidden behavior. The event ID is "MessageReplay", which should be audit-loggable. The rest is all visible in system/messages/messages.properties and error.vm and is all just example behavior.

The only subtlety is that technically MessageReplay doesn't come defined as a "local" error and would cause an error to be sent back to the SP, but a replay is too early and invalidates the possibility of issuing a response.

-- Scott