title: WSO2 Identity Server 5.7.0 with ADFS federation cannot show a error page when saml response has a RequestDenied assertion
body: <p>I'm currently having an issue with the federation between WSO2 Identity Server 5.7.0 and ADFS, when unauthorized users try to access a application registered in WSO2.</p>
  
  <p>As I have described in this <a href="https://stackoverflow.com/questions/58123989/unsuccessfull-issuance-authorization-rule-with-regex">question</a> #58123989, on our organization there are some users belonging to a Active Directory Organizational Unit (OU), that cannot use some Relying Parties (RP) of ADFS. This has been successful implemented with a Issuance Authorization Rule, and when the RP is configured with WS-Federation an error is shown on ADFS page, explaining that the user has no permission to access the application/RP</p>
  
  <p>But, when the RP is federated with a SAML config (like our WSO2 solution), no error is shown on ADFS, and from what I have read, the SAML protocol encourages that the responsibility of presenting authentication errors fall to the Service Providers that request the authentication.
  For my understanding, in our scenario WSO2 IS is simultaneously an RP and SP, and no error page is shown.</p>
  
  <p>So, when a user that belongs to an unallowed OU tries to login, the SAML response that is returned goes like this:</p>
  
  <pre class="lang-xml prettyprint-override"><code>&lt;samlp:Response xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
                  ID="_8e68c63c-6fb4-4dec-8d6d-2c4d885ea36f"
                  Version="2.0"
                  IssueInstant="2019-10-30T09:11:10.159Z"
                  Destination="https://km.apim.ipleiria.pt/commonauth"
                  Consent="urn:oasis:names:tc:SAML:2.0:consent:unspecified"
                  InResponseTo="_c48ab89ffc9dabae2294416785a7c701"
                  &gt;
      &lt;Issuer xmlns="urn:oasis:names:tc:SAML:2.0:assertion"&gt;http://login.ipleiria.pt/adfs/services/trust&lt;/Issuer&gt;
      &lt;ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"&gt;
          &lt;ds:SignedInfo&gt;
              &lt;ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /&gt;
              &lt;ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256" /&gt;
              &lt;ds:Reference URI="#_8e68c63c-6fb4-4dec-8d6d-2c4d885ea36f"&gt;
                  &lt;ds:Transforms&gt;
                      &lt;ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /&gt;
                      &lt;ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /&gt;
                  &lt;/ds:Transforms&gt;
                  &lt;ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256" /&gt;
                  &lt;ds:DigestValue&gt;i2O6tpoM9sv9W7T5J99VENpfSplM0xcs4ocGgdFYwXw=&lt;/ds:DigestValue&gt;
              &lt;/ds:Reference&gt;
          &lt;/ds:SignedInfo&gt;
          &lt;ds:SignatureValue&gt;CoU7XShDtzjVciFP1zvHe5+kXpQ5gsI1XMiEcskqbDvzdAcH4woGYrAGHge9wY2+Nw6aJVfzm6YyKiWRfp83Rl7kny/cVhttApKXQskci/mtOk5BKKm/AMGXbYu82baS8mdJN1M9QDRtQQoDyeoxCv15T1zwKJhMGmweOGpYAXOqO3QKl7QMAPcggwwdp0/j8MRfqN8rqSyQGfbnPdS0Qz8fYWjou6C9T0hbQhfkPJwXHfpNmw4Ar8t7jL2b5K1nkHl4QLw5IHfpbTO9a06AU6j1WSmboAd7/zHs3CxxKYL4YQNpJuUXmac0GK9dkhptc8XWZZ4XUQb7wbvsZ8Hzvg==&lt;/ds:SignatureValue&gt;
          &lt;KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#"&gt;
              &lt;ds:X509Data&gt;
                  &lt;ds:X509Certificate&gt;MIIC3jCCAcagAwIBAgIQE3nSS2FEuKFJ+zFvEamRMjANBgkqhkiG9w0BAQsFADArMSkwJwYDVQQDEyBBREZTIFNpZ25pbmcgLSBsb2dpbi5pcGxlaXJpYS5wdDAeFw0xOTA5MDYxNDA2MTZaFw0yMDA5MDUxNDA2MTZaMCsxKTAnBgNVBAMTIEFERlMgU2lnbmluZyAtIGxvZ2luLmlwbGVpcmlhLnB0MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAkNWCUJTODaV3kfUwLPo60WTdDY7DPxG2cfEni1KRk41tU/3c6xripBSe4ZtPO0mpfPa9iTKrYEXI1yZUZqUvCFV1rVOurKs0/TuRUNOJyViP2z5M1y5XokvY4nCKRHdkGGrp5pfnFcxXb7vl9U8WxsHGKF/3u0qdPHfS8bMkC+9E5Ocq6xlKlGLFEie4V7p7vc/euKTNDfha6Inhpm9oAguZVC2vBlTAPWuUsVjgBeYxreOThsFGAZHISOi+fJd/V6TSMhf4eeR2IfZikvyCUfrP6t7yR9ukBdnrXkRo3g3Nw9la9h4jvPhh9DXGwyek6pZJIusSbCraImHkCvOIawIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQAiMCIMnXpuu9K3ZvojTPcsP7Yeafp9KCudfSTs/EaA3aHSH2oWiS4RpwBzynufTxYaNJpQazUc+xCndcr5rovghVt/z+ui3hdok/ZT4E0TBezYvZWovc0dB2vao8S5wbDLxa/6fnTmVu71UtrlAarThpBD8t14bwHoh1P89yDYrWlOHG726/sLJAb0B1NxtlvXErVXjH7OQcr5jRZj9ZHegKs1rfBugmUovVEQXVTl2Fhasdjfy4FIweo7bghWwU7rQN+QQK8WjbPF6wuH7pDdNgs6CBaOVqlCkjE5Sk8lGDqWd27FKqjBIdOMASQoVQJQj76JG3UnViAUG1M0ClY+&lt;/ds:X509Certificate&gt;
              &lt;/ds:X509Data&gt;
          &lt;/KeyInfo&gt;
      &lt;/ds:Signature&gt;
      &lt;samlp:Status&gt;
          &lt;samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Responder"&gt;
              &lt;samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:RequestDenied" /&gt;
          &lt;/samlp:StatusCode&gt;
      &lt;/samlp:Status&gt;
  &lt;/samlp:Response&gt;
  </code></pre>
  
  <p>As you can see the StatusCode is urn:oasis:names:tc:SAML:2.0:status:RequestDenied.</p>
  
  <p>When the response is processed by WSO2IS, there is an exception thrown with the following message and stack trace: SAML Assertion is not found in the Response</p>
  
  <pre><code>TID: [-1234] [] [2019-10-30 09:11:08,797] ERROR {org.wso2.carbon.identity.application.authentication.framework.handler.step.impl.DefaultStepHandler} -  SAML Assertion is not found in the Response
  org.wso2.carbon.identity.application.authentication.framework.exception.AuthenticationFailedException: SAML Assertion is not found in the Response
          at org.wso2.carbon.identity.application.authenticator.samlsso.SAMLSSOAuthenticator.processAuthenticationResponse(SAMLSSOAuthenticator.java:325)
          at org.wso2.carbon.identity.application.authentication.framework.AbstractApplicationAuthenticator.process(AbstractApplicationAuthenticator.java:77)
          at org.wso2.carbon.identity.application.authentication.framework.handler.step.impl.DefaultStepHandler.doAuthentication(DefaultStepHandler.java:497)
          at org.wso2.carbon.identity.application.authentication.framework.handler.step.impl.DefaultStepHandler.handleResponse(DefaultStepHandler.java:471)
          at org.wso2.carbon.identity.application.authentication.framework.handler.step.impl.DefaultStepHandler.handle(DefaultStepHandler.java:174)
          at org.wso2.carbon.identity.application.authentication.framework.handler.sequence.impl.DefaultStepBasedSequenceHandler.handle(DefaultStepBasedSequenceHandler.java:185)
          at org.wso2.carbon.identity.application.authentication.framework.handler.sequence.impl.GraphBasedSequenceHandler.handle(GraphBasedSequenceHandler.java:102)
          at org.wso2.carbon.identity.application.authentication.framework.handler.request.impl.DefaultAuthenticationRequestHandler.handle(DefaultAuthenticationRequestHandler.java:135)
          at org.wso2.carbon.identity.application.authentication.framework.handler.request.impl.DefaultRequestCoordinator.handle(DefaultRequestCoordinator.java:162)
          at org.wso2.carbon.identity.application.authentication.framework.servlet.CommonAuthenticationServlet.doPost(CommonAuthenticationServlet.java:53)
          at javax.servlet.http.HttpServlet.service(HttpServlet.java:650)
          at javax.servlet.http.HttpServlet.service(HttpServlet.java:731)
          at org.eclipse.equinox.http.helper.ContextPathServletAdaptor.service(ContextPathServletAdaptor.java:37)
          at org.eclipse.equinox.http.servlet.internal.ServletRegistration.service(ServletRegistration.java:61)
          at org.eclipse.equinox.http.servlet.internal.ProxyServlet.processAlias(ProxyServlet.java:128)
          at org.eclipse.equinox.http.servlet.internal.ProxyServlet.service(ProxyServlet.java:60)
          at javax.servlet.http.HttpServlet.service(HttpServlet.java:731)
          at org.wso2.carbon.tomcat.ext.servlet.DelegationServlet.service(DelegationServlet.java:68)
          at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:303)
          at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
          at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52)
          at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241)
          at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
          at org.wso2.carbon.identity.captcha.filter.CaptchaFilter.doFilter(CaptchaFilter.java:76)
          at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241)
          at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
          at org.owasp.csrfguard.CsrfGuardFilter.doFilter(CsrfGuardFilter.java:72)
          at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241)
          at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
          at org.wso2.carbon.tomcat.ext.filter.CharacterSetFilter.doFilter(CharacterSetFilter.java:65)
          at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241)
          at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
          at org.apache.catalina.filters.HttpHeaderSecurityFilter.doFilter(HttpHeaderSecurityFilter.java:124)
          at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241)
          at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
          at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:219)
          at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:110)
          at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:169)
          at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:103)
          at org.wso2.carbon.identity.context.rewrite.valve.TenantContextRewriteValve.invoke(TenantContextRewriteValve.java:80)
          at org.wso2.carbon.identity.authz.valve.AuthorizationValve.invoke(AuthorizationValve.java:91)
          at org.wso2.carbon.identity.auth.valve.AuthenticationValve.invoke(AuthenticationValve.java:65)
          at org.wso2.carbon.tomcat.ext.valves.CompositeValve.continueInvocation(CompositeValve.java:99)
          at org.wso2.carbon.tomcat.ext.valves.CarbonTomcatValve$1.invoke(CarbonTomcatValve.java:47)
          at org.wso2.carbon.webapp.mgt.TenantLazyLoaderValve.invoke(TenantLazyLoaderValve.java:57)
          at org.wso2.carbon.tomcat.ext.valves.TomcatValveContainer.invokeValves(TomcatValveContainer.java:47)
          at org.wso2.carbon.tomcat.ext.valves.CompositeValve.invoke(CompositeValve.java:62)
          at org.wso2.carbon.tomcat.ext.valves.CarbonStuckThreadDetectionValve.invoke(CarbonStuckThreadDetectionValve.java:159)
          at org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:962)
          at org.wso2.carbon.tomcat.ext.valves.CarbonContextCreatorValve.invoke(CarbonContextCreatorValve.java:57)
          at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:116)
          at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:445)
          at org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1115)
          at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:637)
          at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1775)
          at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.run(NioEndpoint.java:1734)
          at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
          at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
          at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
          at java.lang.Thread.run(Thread.java:748)
  Caused by: org.wso2.carbon.identity.application.authenticator.samlsso.exception.SAMLSSOException: SAML Assertion is not found in the Response
          at org.wso2.carbon.identity.application.authenticator.samlsso.manager.DefaultSAML2SSOManager.processSSOResponse(DefaultSAML2SSOManager.java:538)
          at org.wso2.carbon.identity.application.authenticator.samlsso.manager.DefaultSAML2SSOManager.executeSAMLReponse(DefaultSAML2SSOManager.java:383)
          at org.wso2.carbon.identity.application.authenticator.samlsso.manager.DefaultSAML2SSOManager.processSAMLResponse(DefaultSAML2SSOManager.java:374)
          at org.wso2.carbon.identity.application.authenticator.samlsso.manager.DefaultSAML2SSOManager.processResponse(DefaultSAML2SSOManager.java:331)
          at org.wso2.carbon.identity.application.authenticator.samlsso.SAMLSSOAuthenticator.processAuthenticationResponse(SAMLSSOAuthenticator.java:252)
          ... 59 more
  </code></pre>
  
  <p>But no error page is presented to the user, and the connection is returned to the application (usually a Single Page Application, registered in WSO2 Api Manager), with no auth info.</p>
  
  <p>Since ADFS is somewhat scarse in documentation, and of course the SAML protocol rules (that encourages the presentation of errors to fall to the SP), my approach has been to capture the exception thrown by WSO2IS and presenting an error page, although with no success.</p>
  
  <p>How can I capture the error and presenting a page?
  Is there a different approach? 
  Can this be configured in ADFS?</p>