Would it perhaps be an idea of instead of try/catch do something like:

error = cherrypy.request.wsgi_environ.get('EXTERNAL_AUTH_ERROR', 'Unknown error using external authentication')

Do we know the types of errors that might be returned?

I'm thinking these errors might be too technical for the average user: for example with your example "auth token is expired" (in ticket #69), I don't think an average user would think "Auth token is expired" would mean he has an expired password.

So we might want to catch the ones we know, and revert to "Unknown error" for the rest.

(Note: this would also help internationalization if we would want to at some point)

I thought about the dict get with a default rather than try/except but it seemed to me just as readable with try/except without having to span multiple lines. I'm not committed to this format though.

So while we can try to pick and choose error strings it would require substring matches which would be vulnerable to upstream changes (unlikely) and general ugliness. "Authentication token is no longer valid; new one required" and "Authentication failure" are the only messages I was able to generate.