rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Keep SAML auth failures generic for users

Browse Source 
Specific SAML refusal reasons leak organization and account state.
Still redirect to the shared auth error page, but always use
authentication_failed while logging the real cause server-side.

Signed-off-by: Cursor Agent <cursoragent@cursor.com>

Co-authored-by: Bryan FRIMIN <bryan@frimin.fr>
This commit is contained in:
Bryan Frimin
2026-07-24 21:45:31 +00:00
committed by Cursor Agent
parent b8e5d279a0
commit 00ed11e30b
3 changed files with 23 additions and 68 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
pkg/server/api/connect/v1/auth_error.go
View File

@@ -36,12 +36,6 @@ const (
authErrorMagicLinkExpired = "magic_link_expired"
authErrorMagicLinkAlreadyUsed = "magic_link_already_used"
authErrorMagicLinkInvalid = "magic_link_invalid"
authErrorSAMLDisabled = "saml_disabled"
authErrorSAMLConfigurationNotFound = "saml_configuration_not_found"
authErrorSAMLEmailDomainMismatch = "saml_email_domain_mismatch"
authErrorSAMLAutoSignupDisabled = "saml_auto_signup_disabled"
authErrorSAMLUserInactive = "saml_user_inactive"
authErrorSAMLSubjectAlreadyInUse = "saml_subject_already_in_use"
)
func redirectAuthError(w http.ResponseWriter, r *http.Request, code string) {
@@ -56,29 +50,32 @@ func redirectAuthError(w http.ResponseWriter, r *http.Request, code string) {
http.Redirect(w, r, redirectURL.String(), http.StatusFound)
}
// authErrorCodeFromSAML maps known SAML assertion failures to a browser error
// code. Specific SAML reasons stay server-side only; users see a generic
// authentication failure to avoid leaking org/account state.
func authErrorCodeFromSAML(err error) (string, bool) {
if _, ok := errors.AsType[*saml.ErrSAMLDisabled](err); ok {
return authErrorSAMLDisabled, true
return authErrorAuthenticationFailed, true
}
if _, ok := errors.AsType[*saml.ErrSAMLConfigurationNotFound](err); ok {
return authErrorSAMLConfigurationNotFound, true
return authErrorAuthenticationFailed, true
}
if _, ok := errors.AsType[*saml.ErrEmailDomainMismatch](err); ok {
return authErrorSAMLEmailDomainMismatch, true
return authErrorAuthenticationFailed, true
}
if _, ok := errors.AsType[*saml.ErrSAMLAutoSignupDisabled](err); ok {
return authErrorSAMLAutoSignupDisabled, true
return authErrorAuthenticationFailed, true
}
if _, ok := errors.AsType[*saml.ErrUserInactive](err); ok {
return authErrorSAMLUserInactive, true
return authErrorAuthenticationFailed, true
}
if _, ok := errors.AsType[*saml.ErrSAMLSubjectAlreadyInUse](err); ok {
return authErrorSAMLSubjectAlreadyInUse, true
return authErrorAuthenticationFailed, true
}
if _, ok := errors.AsType[*saml.ErrInvalidAssertion](err); ok {