OpenSaml4AuthenticationProvider should include secondary statusCode messages on error #11725
Assignees
Labels
in: saml2
An issue in SAML2 modules
status: duplicate
A duplicate of another issue
type: enhancement
A general enhancement
Comments
kha1989led
added
status: waiting-for-triage
|
Thanks, @kha1989led, I think it makes sense to add this extra detail. Given that a top-level status code may have many secondary status codes, I think we should make sure to include each as an individual error message. Are you able to provide a PR to add this behavior? |
jzheaux
changed the title
|
@jzheaux I can take stab at it. Is there a deadline for when I should provide the PR? |
jzheaux
added
the
status: ideal-for-contribution
|
Hi, @kha1989led, if you are still available, a PR would be most appreciated! |
|
Hi, can i try to resolve this? |
|
@jzheaux I have made a PR, can you check and merge please? |
jzheaux
added a commit
that referenced
this issue
Mar 22, 2024
Adjusted code styling to avoid nested ifs Closes gh-11725
jzheaux
added
status: duplicate
jzheaux
added a commit
to jzheaux/spring-security
that referenced
this issue
Jul 20, 2024
- Use test objects - Ensure assertThat is checked Issue spring-projectsgh-11725
jzheaux
added a commit
that referenced
this issue
Jul 20, 2024
- Use test objects - Ensure assertThat is checked Issue gh-11725
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Expected Behavior
Two cases:
When the
isPassiveflag is set totrue, and the request is sent to an IdP that doesn't support passive mode, the expected statusCode isurn:oasis:names:tc:SAML:2.0:status:NoPassive:Similarly, with the
isPassiveflag, is set totrue, and the request is sent to an IdP that supports passive mode, but the user doesn't have a session yet with the IdP, the expected statusCode isurn:oasis:names:tc:SAML:2.0:status:NoPassiveCurrent Behavior
In the
createDefaultResponseValidatormethod, when the request goes through case 1, the samlResponse looks like this:However, the
createDefaultResponseValidatoruses the outer statusCodeurn:oasis:names:tc:SAML:2.0:status:Responder:Similarly, in case 2, the samlResponse looks like this:
and output from
createDefaultResponseValidatorisurn:oasis:names:tc:SAML:2.0:status:Requester:Context
How has this issue affected you?
I can't tell if the source of the error is
NoPassiveor something else to decide how to proceed with the sign-in flow.What are you trying to accomplish?
I'm implementing a dynamic passive value for multi-tenants, and when the IdP doesn't support passive, or there's no session at the IdP, I'm detecting the error and using the
redirectStrategyto send the user back to the main page. It's a public page that tries to passively log the user in if there's a session with the IdP.What other alternatives have you considered?
None.
Are you aware of any workarounds?
No.
The text was updated successfully, but these errors were encountered: