Upstream errors reach the user verbatim, including OS-level ones

[PianoNic]

Connecting an account with an unreachable Schulnetz URL shows the user this, in the app:

Login failed: [Errno -2] Name or service not known

That is a Python DNS resolution error from SchulwareAPI, passed straight through the plugin into the message the app renders. Errno -2 means nothing to a student, and the actionable part - that the URL could not be resolved, so it is probably mistyped - is not stated.

The same channel carries other upstream text unchanged. A real MFA failure arrives as:

MFA required: MFA required but no TOTP secret/code was provided.. Provide a TOTP secret/code or re-authenticate interactively.

with the heading duplicated into the sentence and a double full stop, which suggests a prefix is being concatenated onto a message that already contains it.

The app now renders whatever message the plugin returns (schulydev/Schuly#455), so the wording here is what the user reads. The common failures worth naming are: host not resolvable, host unreachable or timed out, credentials rejected, and MFA required. Anything genuinely unexpected can stay generic, with the technical detail logged rather than shown.

[PianoNic]

A second case, from a single deliberately-invalid connect against a real Schulnetz instance (https://schulnetz.bbbaden.ch, fake address and password). The user-facing message came back as:

Login failed: Account federated to another IdP: https://sts.microsoftonline.com/Trust/2005/UsernameMixed?client-request-id=…&username=not-a-real-account%40example.com&wa=wsignin1.0&wtrealm=urn%3afederation%3aMicrosoftOnline&wctx=estsredirect%3d2%26estsrequest%3drQQIARAAfdC7axRBAIDxnewlxkPN5lCxUbYICMa525mdfcxCQC_xLpiXJicmdvN0D-92z81eTPIXxE4wlWXsDgux8gFqnULS…

The whole thing is roughly 700 characters and is rendered verbatim in the red text under the Connect button.

Three separate problems in one message:

• The signal is buried. "Account federated to another IdP" is genuinely useful and actionable - this school signs in through Microsoft, so email and password cannot work and the interactive flow is needed. That sentence is worth saying on its own.
• The endpoint URL does not belong in a user-facing string. It is unreadable on a phone and tells a student nothing.
• It reflects the entered identity back. username=…%40example.com is embedded in the URL, so in real use this message - and anything that logs it - contains the student's own email address.

Together with the [Errno -2] Name or service not known case above, the pattern is that whatever the upstream returns is concatenated after Login failed: and passed straight through. "Federated to another identity provider" is a good candidate for the first named case, since it tells the user to use a different sign-in method rather than to retype their password.