Increase verbosity and criticity of failed BC-LO

Admins should be aware that a BCLO attempt failed since it might be a security issue.
On the other side we shouldn't spam them if an unknown IdP is attempting a logout

Signed-off-by: Spitap <dev@asdrip.fr>

Author: Spitfireap

lib/Controller/LoginController.php

@@ -863,6 +863,7 @@ public function backChannelLogout(string $providerIdentifier, string $logout_tok
 			return $this->getBackchannelLogoutErrorResponse(
 				'provider not found',
 				'The provider was not found in Nextcloud',
+				false
 			);
 		}
 
@@ -881,6 +882,7 @@ public function backChannelLogout(string $providerIdentifier, string $logout_tok
 			return $this->getBackchannelLogoutErrorResponse(
 				'invalid audience',
 				'The audience of the logout token does not match the provider',
+				true
 			);
 		}
 
@@ -889,6 +891,7 @@ public function backChannelLogout(string $providerIdentifier, string $logout_tok
 			return $this->getBackchannelLogoutErrorResponse(
 				'invalid event',
 				'The backchannel-logout event was not found in the logout token',
+				true
 			);
 		}
 
@@ -897,13 +900,15 @@ public function backChannelLogout(string $providerIdentifier, string $logout_tok
 			return $this->getBackchannelLogoutErrorResponse(
 				'invalid nonce',
 				'The logout token should not contain a nonce attribute',
+				true
 			);
 		}
 
 		if (!isset($logoutTokenPayload->iss)) {
 			return $this->getBackchannelLogoutErrorResponse(
 				'invalid iss',
 				'The logout token should contain an iss attribute',
+				true
 			);
 		}
 		$iss = $logoutTokenPayload->iss;
@@ -912,6 +917,7 @@ public function backChannelLogout(string $providerIdentifier, string $logout_tok
 			return $this->getBackchannelLogoutErrorResponse(
 				'invalid sid+sub',
 				'The logout token should contain sid or sub or both',
+				true
 			);
 		}
 
@@ -973,8 +979,19 @@ public function backChannelLogout(string $providerIdentifier, string $logout_tok
 	private function getBackchannelLogoutErrorResponse(
 		string $error,
 		string $description,
+		bool $isLikelyIdpSide,
 	): JSONResponse {
-		$this->logger->debug('Backchannel logout error. ' . $error . ' ; ' . $description);
+		// Inform admins that the backchannel logout didn't work because of a misconfiguration
+		if ($isLikelyIdpSide) {
+			$this->logger->error('Backchannel logout error. ' . $error . ' ; ' . $description .
+			'. This is likely an IdP issue.');
+		} else {
+			// If the provider is not found
+			// it might be an unknown OIDC server trying to disconnect unlawfully
+			$this->logger->warning('Backchannel logout error. ' . $error . ' ; ' . $description .
+			'. This is likely a Nextcloud OIDC configuration issue.');
+		}
+
 		return new JSONResponse(
 			[
 				'error' => $error,