Log SSO validation errors

service.go

@@ -224,6 +224,7 @@ func (s *authService) authorizeUser(ctx context.Context, tx TX, req RequestBase)
 	// username (or that the SSO ticket has admin permissions).
 	tkt, err := s.validateSSO(req.SSO)
 	if err != nil {
+		log.Printf("SSO validation error: %s", err)
 		return nil, nil, newAuthError(err)
 	}