Minimal SAML for metadata url about django-allauth HOT 3 OPEN

If we go that route, what should the other SAML endpoints do? Return a status code? Which one? Render render_authentication_error() ?

from django-allauth.

Each endpoint should only error if they don't have the configuration needed for that endpoint's functionality. I'm not immediately sure what that should be as far as a status code. For the moment I'm fine with a 500 error as we're currently doing it, but I'm looking to see if the SAML spec gives any guidance on the appropriate http response codes for these situations.

from django-allauth.

I am by no means confident in my assessment of the spec, but I have not yet found any guidance in the SAML2 spec regarding the appropriate HTTP status codes when the server is misconfigured. It seems to delegate all of that entirely to the SAML messages and leave that undefined.

If the other URLs are misconfigured, any generic error page should be acceptable. That seems like what render_authentication_error() does, so that might be appropriate, but I'm not too familiar with it.

from django-allauth.