KEYCLOAK-4446 Do not encrypt SAML status messages

SAML status messages are not encryptable per Chapter 6 of
saml-core-2.0-os.pdf. Only assertions, attributes, base ID and name ID
can be encrypted.

adapters/saml/core-public/src/main/java/org/keycloak/adapters/saml/SamlAuthenticationError.java

@@ -18,7 +18,10 @@
 package org.keycloak.adapters.saml;
 
 import org.keycloak.adapters.spi.AuthenticationError;
+import org.keycloak.dom.saml.v2.protocol.StatusCodeType;
 import org.keycloak.dom.saml.v2.protocol.StatusResponseType;
+import org.keycloak.saml.common.constants.JBossSAMLURIConstants;
+import java.util.Objects;
 
 /**
  * Object that describes the SAML error that happened.
@@ -27,6 +30,7 @@ import org.keycloak.dom.saml.v2.protocol.StatusResponseType;
  * @version $Revision: 1 $
  */
 public class SamlAuthenticationError implements AuthenticationError {
+
     public static enum Reason {
         EXTRACTION_FAILURE,
         INVALID_SIGNATURE,
@@ -59,7 +63,18 @@ public class SamlAuthenticationError implements AuthenticationError {
 
     @Override
     public String toString() {
-        return "SamlAuthenticationError [reason=" + reason + ", status=" + status + "]";
+        return "SamlAuthenticationError [reason=" + reason + ", status=" 
+          + ((status == null || status.getStatus() == null) ? "UNKNOWN" : extractStatusCode(status.getStatus().getStatusCode()))
+          + "]";
     }
     
+    private String extractStatusCode(StatusCodeType statusCode) {
+        if (statusCode == null || statusCode.getValue() == null) {
+            return "UNKNOWN";
+        }
+        if (Objects.equals(JBossSAMLURIConstants.STATUS_RESPONDER.get(), statusCode.getValue().toString())) {
+            return extractStatusCode(statusCode.getStatusCode());
+        }
+        return statusCode.getValue().toString();
+    }
 }