libre.sh/keycloak-scim
3
0
Fork 0
Code Issues 15 Pull requests Releases 1 Packages Activity Actions

Improve error messages for invalid SAML responses

Browse source 
Closes #13534
This commit is contained in:
Stu Tomlinson 2022-08-02 16:34:42 +01:00 committed by Hynek Mlnařík
parent cc2bb96abc
commit f57560afd3
3 changed files with 8 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
services/src/main/java/org/keycloak/broker/saml/SAMLEndpoint.java
View file

@ -626,7 +626,7 @@ public class SAMLEndpoint {
event.event(EventType.IDENTITY_PROVIDER_RESPONSE); event.event(EventType.IDENTITY_PROVIDER_RESPONSE);
event.detail(Details.REASON, Errors.INVALID_SAML_DOCUMENT); event.detail(Details.REASON, Errors.INVALID_SAML_DOCUMENT);
event.error(Errors.INVALID_SAML_RESPONSE); event.error(Errors.INVALID_SAML_RESPONSE);
return ErrorPage.error(session, null, Response.Status.BAD_REQUEST, Messages.INVALID_FEDERATED_IDENTITY_ACTION); return ErrorPage.error(session, null, Response.Status.BAD_REQUEST, Messages.IDENTITY_PROVIDER_INVALID_RESPONSE);
} }
StatusResponseType statusResponse = (StatusResponseType)holder.getSamlObject(); StatusResponseType statusResponse = (StatusResponseType)holder.getSamlObject();
// validate destination // validate destination
@ -650,7 +650,7 @@ public class SAMLEndpoint {
logger.error("validation failed", e); logger.error("validation failed", e);
event.event(EventType.IDENTITY_PROVIDER_RESPONSE); event.event(EventType.IDENTITY_PROVIDER_RESPONSE);
event.error(Errors.INVALID_SIGNATURE); event.error(Errors.INVALID_SIGNATURE);
return ErrorPage.error(session, null, Response.Status.BAD_REQUEST, Messages.INVALID_FEDERATED_IDENTITY_ACTION); return ErrorPage.error(session, null, Response.Status.BAD_REQUEST, Messages.IDENTITY_PROVIDER_INVALID_SIGNATURE);
} }
} }
if (statusResponse instanceof ResponseType) { if (statusResponse instanceof ResponseType) {

4
services/src/main/java/org/keycloak/services/messages/Messages.java
View file

@ -181,6 +181,10 @@ public class Messages {
public static final String IDENTITY_PROVIDER_MISSING_STATE_ERROR = "identityProviderMissingStateMessage"; public static final String IDENTITY_PROVIDER_MISSING_STATE_ERROR = "identityProviderMissingStateMessage";
public static final String IDENTITY_PROVIDER_INVALID_RESPONSE = "identityProviderInvalidResponseMessage";
public static final String IDENTITY_PROVIDER_INVALID_SIGNATURE = "identityProviderInvalidSignatureMessage";
public static final String IDENTITY_PROVIDER_NOT_FOUND = "identityProviderNotFoundMessage"; public static final String IDENTITY_PROVIDER_NOT_FOUND = "identityProviderNotFoundMessage";
public static final String IDENTITY_PROVIDER_LINK_SUCCESS = "identityProviderLinkSuccess"; public static final String IDENTITY_PROVIDER_LINK_SUCCESS = "identityProviderLinkSuccess";

2
themes/src/main/resources/theme/base/login/messages/messages_en.properties
View file

@ -333,6 +333,8 @@ cookieNotFoundMessage=Cookie not found. Please make sure cookies are enabled in
insufficientLevelOfAuthentication=The requested level of authentication has not been satisfied. insufficientLevelOfAuthentication=The requested level of authentication has not been satisfied.
identityProviderUnexpectedErrorMessage=Unexpected error when authenticating with identity provider identityProviderUnexpectedErrorMessage=Unexpected error when authenticating with identity provider
identityProviderMissingStateMessage=Missing state parameter in response from identity provider. identityProviderMissingStateMessage=Missing state parameter in response from identity provider.
identityProviderInvalidResponseMessage=Invalid response from identity provider.
identityProviderInvalidSignatureMessage=Invalid signature in response from identity provider.
identityProviderNotFoundMessage=Could not find an identity provider with the identifier. identityProviderNotFoundMessage=Could not find an identity provider with the identifier.
identityProviderLinkSuccess=You successfully verified your email. Please go back to your original browser and continue there with the login. identityProviderLinkSuccess=You successfully verified your email. Please go back to your original browser and continue there with the login.
staleCodeMessage=This page is no longer valid, please go back to your application and sign in again staleCodeMessage=This page is no longer valid, please go back to your application and sign in again