OpenSAML user discussion

["Scott Cantor" <>]

> If this is an authorization or authentication service you may not
> want to tell the client why you failed. Thus for this case I would 
> recommend to create a SAMLException that contains NO details on why 
> the operation failed. 

Exactly, which is one reason I haven't spent much time creating a lot of
access to the Status field. In practice, it's just not that useful. I use
SAMLException much more internally to the SP and IdP to pass errors around
than as a way of passing anything useful between sites.

-- Scott