[hammadxcm]

Summary

When validateSubjectConfirmationData() fails during IdP-brokered SAML response handling, the request is rejected with INVALID_SAML_RESPONSE but no log entry or event reason is emitted. This is a regression from f0381f8 ("Check SubjectConfirmationData element for bearer type") and makes the failure undiagnosable at the default log level.

The sibling validations in the same handler — the issuer check and validateInResponseToAttribute() — both log an error before failing. This change adds a matching logger.error to validateSubjectConfirmationData() so the behaviour is consistent.

The detailed failure reasons (recipient / InResponseTo / expiry) continue to be logged at trace level by SubjectConfirmationDataValidator.

Testing

Logging-only change on a path that is hard to reproduce (requires a brokered SAML IdP returning an invalid subject confirmation), so no automated test is added; the change mirrors the existing logging in the same method's siblings.

Closes #48417

---

AI agents were used to assist with locating the code path and drafting this change.

[Copilot]

Pull request overview

This PR restores diagnosability for IdP-brokered SAML response failures by emitting an error-level log entry when validateSubjectConfirmationData() fails inside SAMLEndpoint, aligning it with the existing issuer and InResponseTo validation logging behavior.

Changes:

• Add an error log entry when SubjectConfirmationDataValidator reports invalid SubjectConfirmationData during brokered SAML response handling.

[keycloak-github-bot]

Unreported flaky test detected

If the flaky tests below are affected by the changes, please review and update the changes accordingly. Otherwise, a maintainer should report the flaky tests prior to merging the PR.

org.keycloak.testsuite.cluster.PermissionTicketInvalidationClusterTest#crudWithFailover

Keycloak CI - Clustering IT

jakarta.ws.rs.WebApplicationException: Create method returned status Forbidden (Code: 403); expected status: Created (201). Response body: {"error":"HTTP 403 Forbidden"}
	at org.keycloak.testsuite.admin.ApiUtil.getCreatedId(ApiUtil.java:38)
	at org.keycloak.testsuite.cluster.PermissionTicketInvalidationClusterTest.createClient(PermissionTicketInvalidationClusterTest.java:61)
	at org.keycloak.testsuite.cluster.PermissionTicketInvalidationClusterTest.createTestRealm(PermissionTicketInvalidationClusterTest.java:46)
	at org.keycloak.testsuite.cluster.AbstractInvalidationClusterTestWithTestRealm.createTestRealm(AbstractInvalidationClusterTestWithTestRealm.java:18)
...

Report flaky test

[keycloak-github-bot]

Unreported flaky test detected, please review

[ahus1]

Please avoid merging the main branch into the PR or rebasing the PR unless there are merge conflicts reported by GitHub or a reviewer asks you for a rebase. This prevents spamming reviewers with notifications and saves minutes on the GitHub actions CI. Thanks!

[hammadxcm]

Apologies, noted — will leave it alone unless conflicts appear or a reviewer asks. Thanks!