In the following situation, the authorization server does not redirect back to the original client with a ?error=...&error_description=... type of callback, but rather displays its own error message screen:
The login with an external IdP (such as SAML2 or OAuth2) succeeds
The scope call to an external service returns allow_login: false
This should lead to a redirect with ?error=access_denied&error_description=..., but instead an error screen is displayed directly in the Authorization Server.
In the following situation, the authorization server does not redirect back to the original client with a
?error=...&error_description=...
type of callback, but rather displays its own error message screen:allow_login: false
This should lead to a redirect with
?error=access_denied&error_description=...
, but instead an error screen is displayed directly in the Authorization Server.