Controlling IdP response status based on attribute

[Cantor, Scott]

> Any suggestions on an approach?

I wouldn't really see much point in going that route vs. just having the IdP block the response in a normal fashion since that's a well-supported feature.

But it would be largely equivalent anyway, you'd have to signal a custom event using the context-check flow and then configure that event in errors.xml as a "non-local" event that would result in a response and add a mapping for the event to the SAML status (which offhand I think is possible but don't recall how to do, and probably isn't documented anywhere).

-- Scott