I was helping my teammate (FAS username anweshac) debug a problem with using FAS OpenID to log into Beaker's Gerrit at https://gerrit.beaker-project.org/ .

Turned out that she was accidentally using the wrong username in the OpenID URL: she told Gerrit her ID was achatter.id.fedoraproject.org instead of anweshac.id.fedoraproject.org. But we were confused for a while because Ipsilon would accept her FAS credentials (with username anweshac) even though it didn't match the originally claimed OpenID URL, and then redirect back to our Gerrit with openid.mode=cancel -- with no error message or any indication of what was wrong.

After digging through the logs on the Gerrit side for a while we eventually figured out the mistake. But it would be nice if Ipsilon could show an error to the user somewhere in this case -- perhaps at the step where you have successfully authenticated (with one username) but the claim is rejected because it is for another username -- Ipsilon could show an error instead of 302'ing with openid.mode=cancel.