Merge pull request #105 from miszobi/more-descriptive-error-on-invalid-issuer

Throw a more descriptive exception on invalid issuer to ease debugging

Author: pitbulk

core/src/main/java/com/onelogin/saml2/authn/SamlResponse.java

@@ -264,7 +264,9 @@ public boolean isValid(String requestId) {
 				for (int i = 0; i < issuers.size(); i++) {
 					String issuer = issuers.get(i);
 					if (issuer.isEmpty() || !issuer.equals(settings.getIdpEntityId())) {
-						throw new ValidationError("Invalid issuer in the Assertion/Response", ValidationError.WRONG_ISSUER);
+						throw new ValidationError(
+								String.format("Invalid issuer in the Assertion/Response. Was '%s', but expected '%s'", issuer, settings.getIdpEntityId()),
+								ValidationError.WRONG_ISSUER);
 					}
 				}
 

core/src/main/java/com/onelogin/saml2/logout/LogoutRequest.java

@@ -346,7 +346,10 @@ public Boolean isValid() throws Exception {
 				// Check the issuer
 				String issuer = getIssuer(logoutRequestDocument);
 				if (issuer != null && (issuer.isEmpty() || !issuer.equals(settings.getIdpEntityId()))) {
-					throw new ValidationError("Invalid issuer in the Logout Request", ValidationError.WRONG_ISSUER);
+					throw new ValidationError(
+							String.format("Invalid issuer in the Logout Request. Was '%s', but expected '%s'", issuer, settings.getIdpEntityId()),
+							ValidationError.WRONG_ISSUER
+					);
 				}
 
                 if (settings.getWantMessagesSigned() && (signature == null || signature.isEmpty())) {

core/src/main/java/com/onelogin/saml2/logout/LogoutResponse.java

@@ -203,7 +203,10 @@ public Boolean isValid(String requestId) {
 				// Check issuer
                 String issuer = getIssuer();
                 if (issuer != null && !issuer.isEmpty() && !issuer.equals(settings.getIdpEntityId())) {
-                    throw new ValidationError("Invalid issuer in the Logout Response", ValidationError.WRONG_ISSUER);
+					throw new ValidationError(
+							String.format("Invalid issuer in the Logout Response. Was '%s', but expected '%s'" , issuer, settings.getIdpEntityId()),
+							ValidationError.WRONG_ISSUER
+					);
                 }
 
 				// Check destination

core/src/test/java/com/onelogin/saml2/test/authn/AuthnResponseTest.java

@@ -1628,7 +1628,7 @@ public void testIsInValidIssuer() throws IOException, Error, XPathExpressionExce
 		settings.setStrict(true);
 		samlResponse = new SamlResponse(settings, newHttpRequest(samlResponseEncoded));
 		assertFalse(samlResponse.isValid());
-		assertEquals("Invalid issuer in the Assertion/Response", samlResponse.getError());
+		assertEquals("Invalid issuer in the Assertion/Response. Was 'http://invalid.issuer.example.com/', but expected 'http://idp.example.com/'", samlResponse.getError());
 
 		settings.setStrict(false);
 		samlResponseEncoded = Util.getFileAsString("data/responses/invalids/invalid_issuer_message.xml.base64");

core/src/test/java/com/onelogin/saml2/test/logout/LogoutRequestTest.java

@@ -507,7 +507,7 @@ public void testIsInvalidIssuer() throws Exception {
 		settings.setStrict(true);
 		logoutRequest = new LogoutRequest(settings, httpRequest);
 		assertFalse(logoutRequest.isValid());
-		assertEquals("Invalid issuer in the Logout Request", logoutRequest.getError());
+		assertEquals("Invalid issuer in the Logout Request. Was 'https://example.hello.com/access/saml', but expected 'http://idp.example.com/'", logoutRequest.getError());
 	}
 
 	/**

core/src/test/java/com/onelogin/saml2/test/logout/LogoutResponseTest.java

@@ -318,7 +318,7 @@ public void testIsInValidIssuer() throws XMLEntityException, IOException, URISyn
 
 		settings.setStrict(true);
 		assertFalse(logoutResponse.isValid());
-		assertEquals("Invalid issuer in the Logout Response", logoutResponse.getError());		
+		assertEquals("Invalid issuer in the Logout Response. Was 'http://invalid.example.com/', but expected 'http://idp.example.com/'", logoutResponse.getError());
 	}
 
 	/**