Which HTTP Status to return when external authentication fails?

Question

In my ASP.NET MVC web application, I have an external single-sign-on which is used to authenticate the user centrally in the enterprise. The SSO is supposed to return a "packet" of stuff that identifies the user uniquely, which would then be used to pass to local ASP.NET Owin Cookie Authentication (or alternatively Forms Authentication, or something like that). If for some reason the SSO-provided "packet" of stuff doesn't contained minimum required info, I'd like to handle it in the local ASP.NET level appropriately. It's a pretty severe error and not necessarily something that would commonly occur. So I thought I would do something like this:

public class AuthController() : Controller
{
    public ActionResult Login(string returnUrl)
    {
        // Process external single-sign-on authentication
        bool isSuccess = ProcessExternalAuth();
        if (!success)
            // return appropriate HTTP status code
        else
            // continue with login
    }
}

But I'm not sure which HTTP status code to return. Would something like this be appropriate?

return new HttpStatusCodeResult(
    HttpStatusCode.BadGateway, "SSO authentication failed.");

According to List of HTTP Status Codes , one of the 500 errors would probably be most appropriate:

Response status codes beginning with the digit "5" indicate cases in which the server is aware that it has encountered an error or is otherwise incapable of performing the request...

Answer 1

Error code 401 and error code 403 are typically used for authentication related errors. These however have some standards that go along with them that specify when and how they should be used. In your instance neither of these would quite fit. For example, a 403 is described as ( http://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html ):

403 Forbidden

The server understood the request, but is refusing to fulfill it. Authorization will not help and the request SHOULD NOT be repeated. If the request method was not HEAD and the server wishes to make public why the request has not been fulfilled, it SHOULD describe the reason for the refusal in the entity. If the server does not wish to make this information available to the client, the status code 404 (Not Found) can be used instead.

A good alternative would be to return code 503 (service unavailable).

503 Service Unavailable

The server is currently unable to handle the request due to a temporary overloading or maintenance of the server. The implication is that this is a temporary condition which will be alleviated after some delay.

Answer 2

Errors authenticating clients should be under 401:

401 Unauthorized (RFC 7235)

Similar to 403 Forbidden, but specifically for use when authentication is required and has failed or has not yet been provided. The response must include a WWW-Authenticate header field containing a challenge applicable to the requested resource. See Basic access authentication and Digest access authentication.[36] 401 semantically means "unauthenticated", ie the user does not have the necessary credentials. Note: Some sites issue HTTP 401 when an IP address is banned from the website (usually the website domain) and that specific address is refused permission to access a website.

https://en.wikipedia.org/wiki/List_of_HTTP_status_codes#4xx_Client_Error