Change the default error message for SSO
Request: Can the SSO default authentication error message be updated, perhaps by client instance? Is there any way for users not to hit a dead end but be nudged towards the correct behaviour?
Context: Logging in on the SSO “happy path” works well (users follow directions and know if they already have registered with SmartSimple or not). These users do things in the right order: Users click the Create an account button if they have not previously registered in SmartSimple, or they click the Log in button if they have.
The “unhappy path” does not work, where users think they already registered in SmartSimple, but they in fact have not. These users do things in the wrong order. In this case, those users get a generic “login failed” message with no explanation of what is wrong and no guidance about how to correct the situation.
Steps to reproduce:
- New user clicks Log In instead of Create a new account. They use the SSO username and password.
- Large error page appears with the message “Single sign-on (SSO) authentication failed”. See https://yukon.smartsimple.ca/s_system_message.jsp?messagetype=30
What we would like instead: When users try to login before they have registered, the user is returned to the SmartSimple log in page with a message about required next steps: e.g., "There is no account associated with this email address. Click the Create an Account button to register."
Our implementation manager told us to request this change through the Idea lab. Thank you.
Pippa McNeil
shared this idea
AdminJohn Fulton
(Director of Product Management, SmartSimple, Foundant Technologies)
responded
For security purposes we do not acknowledge or leak the existence of user emails; knowing which emails exist drastically lowers the barrier for attackers. Security frameworks (OWASP, NIST) advise against error messages that reveal the validity of user identifiers.
-
Pippa McNeil
commented
If the proposed message is not acceptable, could we come up with suitable wording that does not mention user emails but still guides new users to register? At a minimum, could the message redirect back to the login page?
Our users authenticate through SSO. We want users to register in SmartSimple, and have open registration, but if the users log in first without registering (because people do not read instructions), we want to help those users get back on track and succeed in accessing SmartSimple.
This generic error message does not explain what they did wrong so it frustrates users and will likely increase admin/user-support effort.