search

steffow / meteor-accounts-saml

SAML SP tested with OpenAM
27 stars 29 forks source link

Lack of root error cause and detailed logging #15

Open jenkinetics opened 7 years ago

jenkinetics commented 7 years ago

When using Rocket.Chat I found that a (probably valid) SAML Response message leads to an generic "Unable to validate response url: Error: Unknown SAML response message" when coming from an IDP based on pysaml2. The same data from a Shibboleth is successful, although the XML detail vary.

The meteor library should provide the root cause why it believes that the SAML response is "unknown", and the logging should be detailed by providing the the received message as XML or DOM, and a log message after each validation decision and exception.

jenkinetics commented 7 years ago

Wrt detailed logging: Looking at the source code of the lib I guess that the reason could be that rocket.chat does not set Meteor.settings.debug in its highest log level.

I understand now that "Unknown SAML response message" actually means that it is neither Response not logoutResponse. In this case it would be good to add the message's root element to the error message, or include the full message.

rhoerbe commented 7 years ago

In general the default logging configuration should write messages that when an error condition occurs during Response processing a traceback and internal object representation of the Response is dumped. For common errors a concise message should replace the traceback.