Problem Statement: 

User is unable to log in due to an Invalid SAML Response, and the Customer wants Atlassian to display the IDP's Generated Error.

The Atlassian Services expect a SAML Payload to contain a SAML Subject, which includes the User's Email Address on the SAML NameID and optionally SAML Attributes with the Givenname, Surname, and a Unique ID on Name/UPN/ObjectID; we don't really consider any other SAML Assertions.

Since their IDP isn't giving us a valid SAML Payload, we should be presenting an "invalid SAML response" message.

Suggestion:

We should pass SAML assertions/responses into an error page to help customers troubleshoot login issues.

We can actually extend that to showing SAML errors on the page instead of just passing the error through the page URL as we currently do.