Logging cleanup on SAML Endpoint #49437

a-orrison · 2026-05-28T14:38:45Z

a-orrison
May 28, 2026

When setting up an IDP it can be pretty easy to mistype or improperly copy and include errant spaces in fields.

It would be a useful change to wrap log values in single quotes to make identifying that easier.

See the example log message below (note the space at the front of the expected okta value):
ERROR [org.keycloak.broker.saml.SAMLEndpoint] (executor-thread-111) Response Issuer validation failed: expected http://www.okta.com/1111122222aaaaabbbbb, actual http://www.okta.com/1111122222aaaaabbbbb

And then the proposed change which would be to wrap the values in single quotes:
ERROR [org.keycloak.broker.saml.SAMLEndpoint] (executor-thread-111) Response Issuer validation failed: expected ' http://www.okta.com/1111122222aaaaabbbbb', actual 'http://www.okta.com/1111122222aaaaabbbbb'

This is a straight forward code change, that follows existing patterns already established here:

keycloak/services/src/main/java/org/keycloak/broker/saml/SAMLEndpoint.java

Line 621 in c072415

    
           logger.warnf(ex, "Not possible to decrypt SAML encryptedId. Please check realm keys of usage ENC in the realm '%s' and make sure there is a key able to decrypt the encryptedId encrypted by identity provider '%s'", realm.getName(), config.getAlias());

This class of change could be done in the following locations within the SAMLEndpoint.java.

keycloak/services/src/main/java/org/keycloak/broker/saml/SAMLEndpoint.java

Line 285 in c072415

logger.warnf("Ignoring invalid certificate: %s", cert);
keycloak/services/src/main/java/org/keycloak/broker/saml/SAMLEndpoint.java

Line 589 in c072415

logger.errorf("Response Issuer validation failed: expected %s, actual %s", config.getIdpEntityId(), responseIssuer);
keycloak/services/src/main/java/org/keycloak/broker/saml/SAMLEndpoint.java

Line 633 in c072415

logger.errorf("Assertion Issuer validation failed: expected %s, actual %s", config.getIdpEntityId(), assertionIssuer);
keycloak/services/src/main/java/org/keycloak/broker/saml/SAMLEndpoint.java

Line 643 in c072415

logger.errorf("no principal in assertion; expected: %s", expectedPrincipalType());

a-orrison · 2026-06-08T13:36:14Z

a-orrison
Jun 8, 2026
Author

Another alternative here would be to make sure that all the fields are trimmed when they are saved to prevent spaces from showing up at the start/end of the fields.

0 replies

Navigation Menu

Repository navigation

Logging cleanup on SAML Endpoint #49437

Uh oh!

{{title}}

Uh oh!

Replies: 1 comment

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

Logging cleanup on SAML Endpoint #49437

Uh oh!

a-orrison May 28, 2026

Replies: 1 comment

Uh oh!

a-orrison Jun 8, 2026 Author

a-orrison
May 28, 2026

a-orrison
Jun 8, 2026
Author