{"record":{"id":"a7fa86599d085fe8","repo":"keycloak/keycloak","slug":"not-supported","errorCode":null,"errorMessage":"Not supported.","messagePattern":"Not supported\\.","errorType":"validation","errorClass":"RuntimeException","httpStatus":null,"severity":"error","filePath":"adapters/saml/core/src/main/java/org/keycloak/adapters/saml/profile/ecp/EcpAuthenticationHandler.java","lineNumber":79,"sourceCode":"        HttpFacade.Request request = httpFacade.getRequest();\n        String acceptHeader = request.getHeader(\"Accept\");\n        String contentTypeHeader = request.getHeader(\"Content-Type\");\n\n        return (acceptHeader != null && acceptHeader.contains(PAOS_CONTENT_TYPE) && request.getHeader(PAOS_HEADER) != null)\n                || (contentTypeHeader != null && contentTypeHeader.contains(PAOS_CONTENT_TYPE));\n    }\n\n    public static SamlAuthenticationHandler create(HttpFacade facade, SamlDeployment deployment, SamlSessionStore sessionStore) {\n        return new EcpAuthenticationHandler(facade, deployment, sessionStore);\n    }\n\n    private  EcpAuthenticationHandler(HttpFacade facade, SamlDeployment deployment, SamlSessionStore sessionStore) {\n        super(facade, deployment, sessionStore);\n    }\n\n    @Override\n    protected AuthOutcome logoutRequest(LogoutRequestType request, String relayState) {\n        throw new RuntimeException(\"Not supported.\");\n    }\n\n\n    @Override\n    public AuthOutcome handle(OnSessionCreated onCreateSession) {\n        String header = facade.getRequest().getHeader(PAOS_HEADER);\n\n        if (header != null) {\n            return doHandle(new SamlInvocationContext(), onCreateSession);\n        } else {\n            try {\n                MessageFactory messageFactory = MessageFactory.newInstance();\n                SOAPMessage soapMessage = messageFactory.createMessage(null, facade.getRequest().getInputStream());\n                SOAPBody soapBody = soapMessage.getSOAPBody();\n                Node authnRequestNode = soapBody.getFirstChild();\n                Document document = DocumentUtil.createDocument();\n\n                document.appendChild(document.importNode(authnRequestNode, true));","sourceCodeStart":61,"sourceCodeEnd":97,"githubUrl":"https://github.com/keycloak/keycloak/blob/66c7e15a3788de7764f07dd2558275a02770e16d/adapters/saml/core/src/main/java/org/keycloak/adapters/saml/profile/ecp/EcpAuthenticationHandler.java#L61-L97","documentation":"EcpAuthenticationHandler explicitly throws this RuntimeException from its overridden logoutRequest — ECP (Enhanced Client Proxy) does not support logout requests, so any attempt to process a SAML LogoutRequest through the ECP handler is rejected outright. It is a deliberate capability limitation, not a transient fault.","triggerScenarios":"An ECP-enabled SAML deployment receives a SAML LogoutRequest and routes it to the EcpAuthenticationHandler; calling logoutRequest() programmatically on an ECP handler instance.","commonSituations":"Deployment is configured for ECP but the flow attempts logout, which the ECP profile does not define; misrouted logout through the ECP handler due to handler-selection logic picking ECP for a logout request.","solutions":["Do not route SAML logout requests through ECP — ECP has no logout profile; handle logout via the standard SP logout endpoint instead.","If ECP was enabled unintentionally, disable it in the deployment so the standard (non-ECP) handler processes logout.","Guard upstream: if the request is a LogoutRequest, dispatch to the non-ECP handler rather than EcpAuthenticationHandler."],"exampleFix":"// before: ECP handler handles all\nif (handler instanceof EcpAuthenticationHandler) { handler.logoutRequest(...); }\n// after: skip logout on ECP, route to standard handler\nif (request is LogoutRequest) { standardHandler.logoutRequest(...); }","handlingStrategy":"validation","validationCode":"if (handler instanceof EcpAuthenticationHandler && request instanceof LogoutRequestType) {\n    // ECP does not support logout — route to the standard handler instead\n    standardHandler.logoutRequest((LogoutRequestType) request, relayState);\n    return;\n}","typeGuard":"boolean supportsLogout(SamlAuthenticationHandler h) {\n    return !(h instanceof EcpAuthenticationHandler);\n}","tryCatchPattern":null,"preventionTips":["Do not enable ECP on endpoints that must handle logout.","Gate logout dispatch on handler capability rather than calling blindly."],"tags":["saml","ecp","logout","not-supported"],"backgroundTag":null,"analyzedSha":"66c7e15a3788de7764f07dd2558275a02770e16d","analyzedAt":"2026-08-14T01:36:42.651Z","schemaVersion":2},"datasetVersion":"2026-08-14T05:17:29.042Z"}