Log the reason for failed SSO authentication on the client side

Trying to work out, from the client side (and even probably from the server side) why SSO authentication failed in Crowd is the biggest POS. It would be great if a simple message like the following could be printed out when SSO authentication fails:

Tried to auth with token NN, but refused because of (EASY TO FIX ERROR ONCE YOU KNOW THE CAUSE)