{"action":"opened","issue":{"url":"https://api.github.com/repos/spring-projects/spring-security-saml/issues/197","repository_url":"https://api.github.com/repos/spring-projects/spring-security-saml","labels_url":"https://api.github.com/repos/spring-projects/spring-security-saml/issues/197/labels{/name}","comments_url":"https://api.github.com/repos/spring-projects/spring-security-saml/issues/197/comments","events_url":"https://api.github.com/repos/spring-projects/spring-security-saml/issues/197/events","html_url":"https://github.com/spring-projects/spring-security-saml/issues/197","id":229944966,"number":197,"title":"SAMLException in SingleLogoutProfileImpl cannot be handled to show a web page with the message ","user":{"login":"edrachev","id":3993050,"avatar_url":"https://avatars0.githubusercontent.com/u/3993050?v=3","gravatar_id":"","url":"https://api.github.com/users/edrachev","html_url":"https://github.com/edrachev","followers_url":"https://api.github.com/users/edrachev/followers","following_url":"https://api.github.com/users/edrachev/following{/other_user}","gists_url":"https://api.github.com/users/edrachev/gists{/gist_id}","starred_url":"https://api.github.com/users/edrachev/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/edrachev/subscriptions","organizations_url":"https://api.github.com/users/edrachev/orgs","repos_url":"https://api.github.com/users/edrachev/repos","events_url":"https://api.github.com/users/edrachev/events{/privacy}","received_events_url":"https://api.github.com/users/edrachev/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2017-05-19T11:16:02Z","updated_at":"2017-05-19T11:16:02Z","closed_at":null,"body":"SP metadata configure with property requireLogoutResponseSigned=true\r\nIf IDP send not signed logout response user sees blank page with URL /saml/SingleLogout\r\n\r\nReason for this behavior:\r\n1. SAMLException in SingleLogoutProfileImpl.processLogoutResponse line 288:\r\n```\r\nif (!context.isInboundSAMLMessageAuthenticated() && context.getLocalExtendedMetadata().isRequireLogoutResponseSigned()) {\r\n    throw new SAMLException(\"Logout Response object is required to be signed by the entity policy: \" + context.getInboundSAMLMessageId());\r\n}\r\n```\r\n2. In SAMLLogoutProcessingFilter.processLogout the exception just is writing to logs (line 159). No exceptions from this method are thrown and chain.doFilter is not invoked:\r\n```\r\ncatch (Exception e) {\r\n    log.debug(\"Received logout response is invalid\", e);\r\n    samlLogger.log(SAMLConstants.LOGOUT_RESPONSE, SAMLConstants.FAILURE, context, e);\r\n}\r\n```\r\n\r\nThe system is misconfigured but it is necessary to show corresponding message to the end user.\r\n\r\nI suggest to throw the exception from this catch block to have chance to process it outside.\r\n\r\nAre other options available?"}}
{"actor":{"display_login":"edrachev"}}