The top-level StatusCode, e.g. urn:oasis:names:tc:SAML:2.0:status:Responder.
OptionalmessageThe StatusMessage, if there was one. It is the identity provider's text; do not show it as yours.
OptionalsubThe second-level StatusCode, e.g. urn:oasis:names:tc:SAML:2.0:status:AuthnFailed.
The status an identity provider answered with, when it was not
Success.