Re: [Unity-idm-discuss] fail Authentication action in translation profile

[Krzysztof B. <kb...@un...>]

Hi,

W dniu 17.07.2020 o 08:28, Sander Apweiler pisze:
> Good morning Krzysztof,
> we tested the fail Authentication action in the translation profiles to
> do a lightweight ABAC/authorisation within unity for service who can't
> do it by itself.
> We encountered some problems/not optimal behaviour in it. The error
> message is only send to service, but not to the users. The services can
> not handle such specific error messages and the user get a very strange
> error at the service. E.g. the error of Nextcloud is:
> "Account not provisioned.
> Your account is not provisioned, access to this service is thus not
> possible."
>
> The user do not really understand why the login fails. From our point
> of view it would be great if the failed authentication error is shown
> to the user, maybe with the possibility to login with another account.
> Do you see a possibility to extend the fail authentication behaviour?

Yes, we can extend this action. Adding a checkbox: "show error 
internally" + its implementation is easy. However, is it going to be 
useful? Just to stop the user on unity error page? Shall we redirect 
back to the service (so the error, perhaps wrong if the service doesn't 
implement error handling correctly, will be shown again)? Or redirect to 
other address (like article in help center)?

Best,
KB