Trying to work out, from the client side (and even probably from the server side) why SSO authentication failed in Crowd is the biggest POS. It would be great if a simple message like the following could be printed out when SSO authentication fails:

Tried to auth with token NN, but refused because of (EASY TO FIX ERROR ONCE YOU KNOW THE CAUSE)