Configure REFEDS MFA on Shibboleth SP
Last updated: 2 September 2026
MFA-specific error handling
The next step in the configuration process is error handling (refer to the SAML Integration Tutorial for Shibboleth error handling).
If the IdP does not support the requested authnContextClassRef, it will respond with a redirect to an error page (at the URL configured within shibboleth2.xml) with the status code opensaml::FatalProfileException.
Example error request parameters
The following example shows the request parameters sent to the configured errorURL when an MFA-related error occurs:
| Parameter | Example value |
|---|---|
| now | Thu Oct 3 04:39:30 2024 |
| requestURL | https://validator.test.aaf.edu.au/Shibboleth.sso/SAML2/POST |
| errorType | opensaml::FatalProfileException |
| errorText | SAML response reported an IdP error. |
| RelayState | https://validator.test.aaf.edu.au/mfa/auth/login |
| contactEmail | mailto:support@aaf.edu.au |
| contactName | AAF Support |
| entityID | https://vho.test.aaf.edu.au/idp/shibboleth |
| eventType | Login |
| statusCode | urn:oasis:names:tc:SAML:2.0:status:Requester |
| statusCode2 | urn:oasis:names:tc:SAML:2.0:status:NoAuthnContext |
| statusMessage | An error occurred. |
For more information on requiring MFA and error handling, refer to the links below:
Tutorial Complete!
You have completed this tutorial. Continue with the other tutorials in the Series or return to the tutorials home page.
Return Home