# Catch OIDC Errors When Logging In

**URL:** <https://forum.inductiveautomation.com/t/catch-oidc-errors-when-logging-in/97676>\
**Category:** Ignition\
**Tags:** perspective\
**Created:** [October 23, 2024, 3:46pm UTC](https://forum.inductiveautomation.com/t/catch-oidc-errors-when-logging-in/97676 "2024-10-23T15:46:29Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Michael\_White](https://avatars.discourse-cdn.com/v4/letter/m/c6cbf5/32.png) [@Michael\_White](https://forum.inductiveautomation.com/u/Michael_White)\
**Post date:** [October 23, 2024, 3:46pm UTC](https://forum.inductiveautomation.com/t/catch-oidc-errors-when-logging-in/97676/1 "2024-10-23T15:46:29Z")

</div>

We use Auth0 via OIDC as our IDP for our project. We require email verification, and when you attempt to login without a verified email, auth0 rejects the login.

When logging in, I see I get redirected to `<gateway>/data/federate/callback/oidc?error=access_denied&error_description=Please%20verify%20your%20email%20before%20logging%20in.&state=asdf`  
which the immediately redirects me back to the login screen. However, no message or anything is displayed here or anywhere during the process.

I see it gets logged as

```python
Caused by: com.inductiveautomation.ignition.gateway.auth.web.strategy.WebAuthStrategyException: Unable to parse the web auth response from the HTTP request URI: com.inductiveautomation.ignition.gateway.auth.oidc.error.OIDCError@44c478ef[error=access_denied,error_description=Please verify your email before logging in.,error_uri=<null>,state=asdf]

```

Can I capture, or otherwise display for user feedback, info about login failures?

---

<div class="post-metadata">

**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\
**Post date:** [October 23, 2024, 4:57pm UTC](https://forum.inductiveautomation.com/t/catch-oidc-errors-when-logging-in/97676/2 "2024-10-23T16:57:59Z")

</div>

> [@Michael\_White](#):
>
> otherwise display for user feedback, info about login failures

You might be able to, but you should not. It gives attackers insight into your systems that you do not want them to have.

---

<div class="post-metadata">

**Author:** ![Michael\_White](https://avatars.discourse-cdn.com/v4/letter/m/c6cbf5/32.png) [@Michael\_White](https://forum.inductiveautomation.com/u/Michael_White)\
**Post date:** [October 23, 2024, 5:40pm UTC](https://forum.inductiveautomation.com/t/catch-oidc-errors-when-logging-in/97676/3 "2024-10-23T17:40:35Z")

</div>

What if we parse the response to only show info we want to display, and only if its something that should be displayed?

---

<div class="post-metadata">

**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\
**Post date:** [October 23, 2024, 5:42pm UTC](https://forum.inductiveautomation.com/t/catch-oidc-errors-when-logging-in/97676/4 "2024-10-23T17:42:43Z")

</div>

> [@Michael\_White](#):
>
> that should be displayed?

There is nothing that should be displayed on authentication failure.

---

<div class="post-metadata">

**Author:** ![Michael\_White](https://avatars.discourse-cdn.com/v4/letter/m/c6cbf5/32.png) [@Michael\_White](https://forum.inductiveautomation.com/u/Michael_White)\
**Post date:** [October 23, 2024, 5:44pm UTC](https://forum.inductiveautomation.com/t/catch-oidc-errors-when-logging-in/97676/5 "2024-10-23T17:44:31Z")

</div>

What would be the best course of action then if I need to notify users that they can't login because, for example, their email isn't validated.

For a user, they just keep getting sent back to the login screen with no indication why. That doesn't really seem like a good login flow.

---

<div class="post-metadata">

**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\
**Post date:** [October 23, 2024, 5:45pm UTC](https://forum.inductiveautomation.com/t/catch-oidc-errors-when-logging-in/97676/6 "2024-10-23T17:45:52Z")

</div>

> [@Michael\_White](#):
>
> they just keep getting sent back to the login screen with no indication why

That is precisely what is required when dealing with attackers. Users should be able to contact an IT group who has access (and training) to check the Ignition log.