Yes, I tried this. The STS sends back 400 or 401. In both cases, the body contains an error code, which sets the "protocolCode" part of the error. That said, while testing this, I uncovered a few bugs: HTTP 401 was not handled; the code above should be (AD_SUCCEEDED == result.status) and the protocolCode was not set correctly by the error object. I am expanding the test coverage and the fixes in the next iteration of the pull request.