Repository navigation
Failed authentication results in unhandled exception at SP #2594
Description
When an IdP response to an SimpleSAMLphp SP does not contain a successful authentication, the SP will show an unhandled exception.
Although uncommon, it is a valid scenario.
Ideally the SP would handle this more graceful, with a user friendly message that describes better what is going on.
If the flow stops at the SP with an unhandled exception, the user will perceive this as a problem with the SP, while the real problem lies at the IdP.
Activity
tvdijen commentedon Feb 13, 2026
I suggest we:
SimpleSAML\SAML2\Exception\ProtocolViolationExceptionand treat it any way we want to.tvdijen commentedon Feb 13, 2026
We should keep in mind the errorURL-behaviour that has been recently added. It should not affect that
thijskh commentedon Feb 14, 2026
Some inspiration for the end user messaging might be what OpenConext currently does in this case:
It tries to clearly indicate that you need to go to your own identity provider / institution to get this fixed.
Improvement is probably to move status code and message more up, as in theory they should provide to most concrete context about the problem encountered (in practice the message is often empty nonetheless).
monkeyiq commentedon Mar 10, 2026
Digging into this a bit I see if I add a throw
Error\Error('NOACCESS');inside the SQL authsource then I seeI was just looking for something to throw in the authsource.
I am thinking here the outcome we are looking for is for that message to indicate that it has happened IdP side so the user might direct their efforts that the IdP rather than the tool they are trying to login with.
This is also with my more local dev test env.
tvdijen commentedon Mar 10, 2026
The NOACCESS-error is a SimpleSAML-error indicating that something is wrong in the SSP-application.
What we are talking about in this thread are exceptions sent between IDP/SP in SAML 2.0 messages as defined in the SAML 2.0 core specifications.