rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Log only unexpected auth callback failures

Browse Source 
Expected refusals already have a dedicated auth error page, so
warn logs just add noise. Keep Error logging for generic
authentication failures that still need investigation.

Signed-off-by: Cursor Agent <cursoragent@cursor.com>

Co-authored-by: Bryan FRIMIN <bryan@frimin.fr>
This commit is contained in:
Bryan Frimin
2026-07-24 22:25:06 +00:00
committed by Cursor Agent
parent 4e895df54f
commit 6cce9b0a6e
2 changed files with 1 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
pkg/server/api/connect/v1/oidc_handler.go
View File

@@ -110,7 +110,7 @@ func (h *OIDCHandler) CallbackHandler(w http.ResponseWriter, r *http.Request) {
errParam := r.URL.Query().Get("error") errParam := r.URL.Query().Get("error")
if errParam != "" { if errParam != "" {
h.logger.WarnCtx( h.logger.ErrorCtx(
ctx, ctx,
"OIDC provider returned error", "OIDC provider returned error",
log.String("error", errParam), log.String("error", errParam),
@@ -125,7 +125,6 @@ func (h *OIDCHandler) CallbackHandler(w http.ResponseWriter, r *http.Request) {
code := r.URL.Query().Get("code") code := r.URL.Query().Get("code")
if stateParam == "" || code == "" { if stateParam == "" || code == "" {
h.logger.WarnCtx(ctx, "OIDC callback missing state or code")
redirectAuthError(w, r, authErrorInvalidState) redirectAuthError(w, r, authErrorInvalidState)
return return
@@ -134,21 +133,18 @@ func (h *OIDCHandler) CallbackHandler(w http.ResponseWriter, r *http.Request) {
identity, continueURL, organizationID, err := h.iam.OIDCService.HandleCallback(ctx, provider, stateParam, code) identity, continueURL, organizationID, err := h.iam.OIDCService.HandleCallback(ctx, provider, stateParam, code)
if err != nil { if err != nil {
if _, ok := errors.AsType[*oidc.ErrPersonalAccountNotAllowed](err); ok { if _, ok := errors.AsType[*oidc.ErrPersonalAccountNotAllowed](err); ok {
h.logger.WarnCtx(ctx, "OIDC login rejected: personal account not allowed")
redirectAuthError(w, r, authErrorPersonalAccountNotAllowed) redirectAuthError(w, r, authErrorPersonalAccountNotAllowed)
return return
} }
if _, ok := errors.AsType[*oidc.ErrEmailNotVerified](err); ok { if _, ok := errors.AsType[*oidc.ErrEmailNotVerified](err); ok {
h.logger.WarnCtx(ctx, "OIDC login rejected: email not verified")
redirectAuthError(w, r, authErrorEmailNotVerified) redirectAuthError(w, r, authErrorEmailNotVerified)
return return
} }
if _, ok := errors.AsType[*oidc.ErrInvalidState](err); ok { if _, ok := errors.AsType[*oidc.ErrInvalidState](err); ok {
h.logger.WarnCtx(ctx, "OIDC login rejected: invalid or expired state")
redirectAuthError(w, r, authErrorInvalidState) redirectAuthError(w, r, authErrorInvalidState)
return return

1
pkg/server/api/connect/v1/saml_handler.go
View File

@@ -61,7 +61,6 @@ func (h *SAMLHandler) renderInternalServerError(w http.ResponseWriter) {
func (h *SAMLHandler) renderAssertionError(w http.ResponseWriter, r *http.Request, err error) { func (h *SAMLHandler) renderAssertionError(w http.ResponseWriter, r *http.Request, err error) {
if code, ok := authErrorCodeFromSAML(err); ok { if code, ok := authErrorCodeFromSAML(err); ok {
h.logger.WarnCtx(r.Context(), "SAML login rejected", log.Error(err), log.String("error_code", code))
redirectAuthError(w, r, code) redirectAuthError(w, r, code)
return return