From 6cce9b0a6edd6f9cf59b524ee2af21adf4191534 Mon Sep 17 00:00:00 2001 From: Bryan Frimin Date: Fri, 24 Jul 2026 22:25:06 +0000 Subject: [PATCH] Log only unexpected auth callback failures Expected refusals already have a dedicated auth error page, so warn logs just add noise. Keep Error logging for generic authentication failures that still need investigation. Signed-off-by: Cursor Agent Co-authored-by: Bryan FRIMIN --- pkg/server/api/connect/v1/oidc_handler.go | 6 +----- pkg/server/api/connect/v1/saml_handler.go | 1 - 2 files changed, 1 insertion(+), 6 deletions(-) diff --git a/pkg/server/api/connect/v1/oidc_handler.go b/pkg/server/api/connect/v1/oidc_handler.go index 40a608ba1..a5d2857ce 100644 --- a/pkg/server/api/connect/v1/oidc_handler.go +++ b/pkg/server/api/connect/v1/oidc_handler.go @@ -110,7 +110,7 @@ func (h *OIDCHandler) CallbackHandler(w http.ResponseWriter, r *http.Request) { errParam := r.URL.Query().Get("error") if errParam != "" { - h.logger.WarnCtx( + h.logger.ErrorCtx( ctx, "OIDC provider returned error", log.String("error", errParam), @@ -125,7 +125,6 @@ func (h *OIDCHandler) CallbackHandler(w http.ResponseWriter, r *http.Request) { code := r.URL.Query().Get("code") if stateParam == "" || code == "" { - h.logger.WarnCtx(ctx, "OIDC callback missing state or code") redirectAuthError(w, r, authErrorInvalidState) return @@ -134,21 +133,18 @@ func (h *OIDCHandler) CallbackHandler(w http.ResponseWriter, r *http.Request) { identity, continueURL, organizationID, err := h.iam.OIDCService.HandleCallback(ctx, provider, stateParam, code) if err != nil { if _, ok := errors.AsType[*oidc.ErrPersonalAccountNotAllowed](err); ok { - h.logger.WarnCtx(ctx, "OIDC login rejected: personal account not allowed") redirectAuthError(w, r, authErrorPersonalAccountNotAllowed) return } if _, ok := errors.AsType[*oidc.ErrEmailNotVerified](err); ok { - h.logger.WarnCtx(ctx, "OIDC login rejected: email not verified") redirectAuthError(w, r, authErrorEmailNotVerified) return } if _, ok := errors.AsType[*oidc.ErrInvalidState](err); ok { - h.logger.WarnCtx(ctx, "OIDC login rejected: invalid or expired state") redirectAuthError(w, r, authErrorInvalidState) return diff --git a/pkg/server/api/connect/v1/saml_handler.go b/pkg/server/api/connect/v1/saml_handler.go index 844494952..e655e6306 100644 --- a/pkg/server/api/connect/v1/saml_handler.go +++ b/pkg/server/api/connect/v1/saml_handler.go @@ -61,7 +61,6 @@ func (h *SAMLHandler) renderInternalServerError(w http.ResponseWriter) { func (h *SAMLHandler) renderAssertionError(w http.ResponseWriter, r *http.Request, err error) { if code, ok := authErrorCodeFromSAML(err); ok { - h.logger.WarnCtx(r.Context(), "SAML login rejected", log.Error(err), log.String("error_code", code)) redirectAuthError(w, r, code) return