From e196262a5a254b3bda48d39b2b5f9400aa950e52 Mon Sep 17 00:00:00 2001 From: nfebe Date: Thu, 12 Mar 2026 15:31:47 +0100 Subject: [PATCH] fix(gss): Improve error logging for JWT decode failures in SLS Changed log level from debug to error for GSS JWT decode failures in singleLogoutService. Added specific DomainException handling with actionable message about minimum key length requirement (32 chars for HS256 per RFC 7518). Signed-off-by: nfebe --- lib/Controller/LoginController.php | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/lib/Controller/LoginController.php b/lib/Controller/LoginController.php index 90b3d51e4..96a3c2315 100644 --- a/lib/Controller/LoginController.php +++ b/lib/Controller/LoginController.php @@ -729,8 +729,14 @@ public function singleLogoutService() { $decoded = (array)JWT::decode($jwt, new Key($key, 'HS256')); $providerId = $decoded['oidcProviderId'] ?? null; + } catch (\DomainException $e) { + $this->logger->error( + 'Failed to decode GSS JWT: ' . $e->getMessage() + . '. If the key is too short, gss.jwt.key must be at least 32 characters for HS256 (per RFC 7518).', + ['exception' => $e] + ); } catch (\Exception $e) { - $this->logger->debug('Failed to get the logout provider ID in the request from GSS', ['exception' => $e]); + $this->logger->error('Failed to decode GSS JWT in single logout', ['exception' => $e]); } } else { $providerId = $this->session->get(self::PROVIDERID);