Purpose:
This document describes the federation's generic error page for use with the errorURL parameter in SAML metadata. It offers a fallback mechanism for failed logins and helps SPs and IdPs troubleshoot authentication and authorization issues.
Note: This implementation is meant as a reference or backup. Identity Providers are encouraged to implement their own branded error page to provide clearer, institution-specific guidance to users.
The error page:
Shows localized error messages (Swedish by default, English toggle)
Accepts context parameters from SPs to provide technical detail
Presents users with understandable instructions
Offers an expandable technical diagnostics section
Complies with the REFEDS ErrorURL v1 specification
Sending personally identifiable information in the parameters is not allowed. |
The generic errorURL handler is available for Skolfederation production and test environments. Find the federation specific errorURL implementations below.
| Federation | errorURL (for including in IdPSSODescriptor errorURL attribute) |
|---|---|
| Skolfederation production environment | https://fed.skolfederation.se/prod/error/error.html?code=ERRORURL_CODE&ts=ERRORURL_TS&rp=ERRORURL_RP&tid=ERRORURL_TID&ctx=ERRORURL_CTX |
| Skolfederation test environment | https://fed.skolfederation.se/trial/error/error.html?code=ERRORURL_CODE&ts=ERRORURL_TS&rp=ERRORURL_RP&tid=ERRORURL_TID&ctx=ERRORURL_CTX |
https://<federation-operator>/error.html?code=...&ts=...&ctx=...&rp=...All parameters should be URL-encoded.
| Parameter | Required | Description |
|---|---|---|
code | Yes | Error code (see below) |
ts | Optional | Unix epoch timestamp |
ctx | Optional | Context-specific message for diagnostics |
rp | Optional | SP entityID (displayed in diagnostics) |
tid | Optional | Transaction or session identifiers |
The interface defaults to Swedish
A button allows toggling to English
Parameter content (e.g. ctx) is shown verbatim
| Code | Description | Example Cause |
IDENTIFICATION_FAILURE | Required user attributes are missing | Missing mail or givenName |
AUTHENTICATION_FAILURE | Authentication strength did not meet SP's requirements | Missing 2FA |
AUTHORIZATION_FAILURE | User is not authorized to access the service | Missing role or affiliation |
OTHER_ERROR | Other technical or session-related error | Timeout or metadata issues |
UNKNOWN | Code was missing or invalid | Fallback scenario |
ctx Parameter (Contextual Information)According to section 2.3.4 of the REFEDS specification:
IDENTIFICATION_FAILURE: List of missing attributes or entity category URIs
AUTHENTICATION_FAILURE: List of required authentication context/classref values
AUTHORIZATION_FAILURE: Short policy description of why access was denied
OTHER_ERROR: Brief technical description useful for troubleshooting
This value is shown beneath the main message when present.
An expandable section shows:
All received URL parameters
If ts is present:
Raw epoch format (e.g. 1717580800)
ISO 8601 UTC timestamp (e.g. 2024-06-05T08:26:40.000Z)
Copy-to-clipboard support
This section is meant for IT support or helpdesk use.
When an error occurs, the SP SHOULD present its own error page to the user. If the specific error condition falls into one of the categories for which this profile is appropriate, the SP MAY process the IdPs errorURL value from its metadata, as described above, and provide a link to the decorated URL. |
Always supply mandatory code parameter. All other parameters are optional, but strongly recommended when applicable.
ERRORURL_CODE, ERRORURL_TS, and so on) with actual values. Sending user-identifying data in any parameters is not allowed.
Provide fallback helpdesk contact or guidance to users
Include the corresponding federation value for errorURL in the IDPSSODescriptor to make the generic errorURL available for usage by Service Providers.
Metadata example: Skolfederation production environment
<IDPSSODescriptor ... errorURL=”https://fed.skolfederation.se/prod/error/error.html?code=ERRORURL_CODE&ts=ERRORURL_TS&rp=ERRORURL_RP&tid=ERRORURL_TID&ctx=ERRORURL_CTX”> |
Use this page as a fallback only (e.g. while setting up or if a local errorURL cannot be set up for some reason)
Monitor and log the ctx, rp, and ts parameters for issue resolution
Output:
Main message: "Required attributes to identify or personalize your session are missing."
Context: "Missing attributes: eduPersonPrincipalName"
Technical section:
code = IDENTIFICATION_FAILURE
ts = 1717580800 (2024-06-05T08:26:40.000Z)
ctx = eduPersonPrincipalName
rp = https://sp.example.se