Greetings,
Since we support different authentication mechanisms for Canvas, we use a Discovery URL pointing to a page on our university's site to help people navigate to the appropriate place to login. Linking to the different login URLs is simple enough, but one of the things that was missed in our initial implementation was login error handling. So now we're trying to add at least some indication if there was a problem and context to provide our support folks.
We know that on a login error, Canvas will redirect back to the discovery page with a `message` URL parameter containing a message the error.
We can even find some of these possible messages from the Canvas login controllers, e.g. https://github.com/instructure/canvas-lms/blob/master/app/controllers/login/saml_controller.rb
However, our developers are, rightly, concerned about just writing any URL parameter message to the official LMS login page for fear that it could be abused to post official looking messages or direct people to malicious URLs.
While they are considering their own solutions, I just wanted to ask how others are handling the login errors that return to Discovery URL, to ensure it is an actual message returned from Canvas?
