Question: I have an Ooth authentication server with PassportJS, a GraphQL API and a Gatsby client, I want to get my error messages in a bootstrap alert when my handleLogin function returns the catch, how can I do that?

auth.js

```
export const handleLogin = async ({ email, password }) => {
    const user = await ooth.authenticate('local', 'login', {
        username: email,
        password: password,
    }).catch(e => { 
        console.log(e)
     });
    await navigate(`/app/profile`);
    if (user) {
        return setUser({
            id: user._id,
            username: `jovaan`,
            name: `Jovan`,
            email: user.local.email,
            avatar: `3`,
            telephone: `0788962157`,
            bio: `I'm a front-end dev`
        })
    }
    return false
}

```

Alert.js 

```
import React from "react";
import { Alert } from "shards-react";

export default class DismissibleAlert extends React.Component {
  constructor(props) {
    super(props);
    this.dismiss = this.dismiss.bind(this);
    this.state = { visible: true, message: "Message par défaut" };

  }

  render() {
    return (
      <Alert dismissible={this.dismiss} open={this.state.visible} theme="success">
        {this.message()}
      </Alert>
    );
  }

  dismiss() {
    this.setState({ visible: false });
  }

  message() {
      return this.state.message
  }
}

```

Answer: 
Sort of. The authentication request from SP to IdP is allowed to have "custom" extensions (the Extensions parent element), the content of the extensions is up to you. From the spec:

> 
>  [Optional] This extension point contains optional
>  protocol message extension elements that are agreed on between the
>  communicating parties. No extension schema is required in order to
>  make use of this extension point, and even if one is provided, the lax
>  validation setting does not impose a requirement for the extension to
>  be valid. SAML extension elements MUST be namespace-qualified in a
>  non-SAML-defined namespace.
> 
> 
> 

If you're writing your own IdP, you could certainly make use of Extensions and do whatever you wish with it. "Standard" (commercial/OSS) IdPs won't know what to do with your extension. It'd be an interesting test to see if Shibboleth or Keycloak libraries parse the Extensions element and give you the contents.

The other, more standard possibility is using RelayState. This is a spec-compliant way of passing some provider-specific state information around, incl. from SP to IdP:

> 
> 3.1.1 Use of RelayState Some bindings define a "RelayState" mechanism for preserving and conveying state information. When such a mechanism
>  is used in conveying a request message as the initial step of a SAML
>  protocol, it places requirements on the selection and use of the
>  binding subsequently used to convey the response. Namely, if a SAML
>  request message is accompanied by RelayState data, then the SAML
>  responder MUST return its SAML protocol response using a binding that
>  also supports a RelayState mechanism, and it MUST place the exact
>  RelayState data it received with the request into the corresponding
>  RelayState parameter in the response.
> 
> 
> 

Again, all IdPs or downstack libraries will parse RelayState but how they handle it from there depends on their reading of the spec. For one, the spec requires RelayState to be 80 bytes and integrity protection via a signature or "other means". This limitation is often ignored by IdPs and SPs.

What SP-specific information are you trying to display on IdP login page?
The only thing that an SP can send to the IdP is the `Subject` (see [lines 585-589](https://www.oasis-open.org/committees/download.php/56782/sstc-saml-profiles-errata-2.0-wd-07.pdf#page=18) of the spec).