3.1.4.7.2 Element <StatusCode>

The <StatusCode> element contains a code or a set of nested codes that represent the status of the request. Every <StatusCode> element has the following attribute:

Attribute

Required/Optional

Description

Value

Required

The status code value. This value MUST contain a URI reference. The Value attribute of the top-level <StatusCode> element MUST be one of the top-level status codes given in this section. Subordinate <StatusCode> elements MAY use second-level status code values given in this section.

The <StatusCode> element MAY contain subordinate second-level <StatusCode> elements that provide additional information on the error condition.

The permissible top-level status codes are:

Status code

Description

urn:oasis:names:tc:SAML:2.0:status:Success

The request succeeded.

urn:oasis:names:tc:SAML:2.0:status:Requester

The request could not be performed due to an error on the part of the requester.

urn:oasis:names:tc:SAML:2.0:status:Responder

The request could not be performed due to an error on the part of the SAML responder or SAML authority.

urn:oasis:names:tc:SAML:2.0:status:VersionMismatch

The SAML responder could not process the request because the version of the request message was incorrect.

The second-level status codes are:

Status code

Description

urn:oasis:names:tc:SAML:2.0:status:AuthnFailed

The responding provider was unable to successfully authenticate the principal.

urn:oasis:names:tc:SAML:2.0:status:InvalidAttrNameOrValue

Unexpected or invalid content was encountered within a <saml:Attribute> or <saml:AttributeValue> element.

urn:oasis:names:tc:SAML:2.0:status:InvalidNameIDPolicy

The responding provider cannot or will not support the requested name identifier policy.

urn:oasis:names:tc:SAML:2.0:status:NoAuthnContext

The specified authentication context requirements cannot be met by the responder.

urn:oasis:names:tc:SAML:2.0:status:NoAvailableIDP

Used by an intermediary to indicate that none of the supported identity provider <Loc> elements in an <IDPList> can be resolved or that none of the supported identity providers are available.

urn:oasis:names:tc:SAML:2.0:status:NoPassive

Indicates that the responding provider cannot authenticate the principal passively, as has been requested.

urn:oasis:names:tc:SAML:2.0:status:NoSupportedIDP

Used by an intermediary to indicate that none of the identity providers in an <IDPList> are supported by the intermediary.

urn:oasis:names:tc:SAML:2.0:status:PartialLogout

Used by a session authority to indicate to a session participant that it was not able to propagate the logout request to all other session participants.

urn:oasis:names:tc:SAML:2.0:status:ProxyCountExceeded

Indicates that a responding provider cannot authenticate the principal directly and is not permitted to proxy the request further.

urn:oasis:names:tc:SAML:2.0:status:RequestDenied

The SAML responder or SAML authority is able to process the request but has chosen not to respond. This status code MAY be used when there is concern about the security context of the request message or the sequence of request messages received from a particular requester.

urn:oasis:names:tc:SAML:2.0:status:RequestUnsupported

The SAML responder or SAML authority does not support the request.

urn:oasis:names:tc:SAML:2.0:status:RequestVersionDeprecated

The SAML responder cannot process any requests with the protocol version specified in the request.

urn:oasis:names:tc:SAML:2.0:status:RequestVersionTooHigh

The SAML responder cannot process the request because the protocol version specified in the request message is a major upgrade from the highest protocol version supported by the responder.

urn:oasis:names:tc:SAML:2.0:status:RequestVersionTooLow

The SAML responder cannot process the request because the protocol version specified in the request message is too low.

urn:oasis:names:tc:SAML:2.0:status:ResourceNotRecognized

The resource value provided in the request message is invalid or unrecognized.

urn:oasis:names:tc:SAML:2.0:status:TooManyResponses

The response message would contain more elements than the SAML responder is able to return.

urn:oasis:names:tc:SAML:2.0:status:UnknownAttrProfile

An entity that has no knowledge of a particular attribute profile has been presented with an attribute drawn from that profile.

urn:oasis:names:tc:SAML:2.0:status:UnknownPrincipal

The responding provider does not recognize the principal specified or implied by the request.

urn:oasis:names:tc:SAML:2.0:status:UnsupportedBinding

The SAML responder cannot properly fulfill the request using the protocol binding specified in the request.

The following schema fragment defines the <StatusCode> element and its corresponding StatusCodeType complex type:

 <element name="StatusCode" type="samlp:StatusCodeType"/>
 <complexType name="StatusCodeType">
     <sequence>
         <element ref="samlp:StatusCode" minOccurs="0"/>
     </sequence>
     <attribute name="Value" type="anyURI" use="required"/>
 </complexType>
Show: