rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Keep SAML auth failures generic for users

Browse Source 
Specific SAML refusal reasons leak organization and account state.
Still redirect to the shared auth error page, but always use
authentication_failed while logging the real cause server-side.

Signed-off-by: Cursor Agent <cursoragent@cursor.com>

Co-authored-by: Bryan FRIMIN <bryan@frimin.fr>
This commit is contained in:
Bryan Frimin
2026-07-24 21:45:31 +00:00
committed by Cursor Agent
parent b8e5d279a0
commit 00ed11e30b
3 changed files with 23 additions and 68 deletions
Download Patch File Download Diff File Expand all files Collapse all files

28
pkg/server/api/connect/v1/auth_error_test.go
View File

@@ -63,49 +63,49 @@ func TestAuthErrorCodeFromSAML(t *testing.T) {
ok bool
}{
{
name: "disabled",
name: "disabled stays generic",
err: saml.NewSAMLDisabledError(),
code: authErrorSAMLDisabled,
code: authErrorAuthenticationFailed,
ok: true,
},
{
name: "configuration not found",
name: "configuration not found stays generic",
err: saml.NewSAMLConfigurationNotFoundError(configID),
code: authErrorSAMLConfigurationNotFound,
code: authErrorAuthenticationFailed,
ok: true,
},
{
name: "email domain mismatch",
name: "email domain mismatch stays generic",
err: saml.NewEmailDomainMismatchError(email, "acme.com"),
code: authErrorSAMLEmailDomainMismatch,
code: authErrorAuthenticationFailed,
ok: true,
},
{
name: "auto signup disabled",
name: "auto signup disabled stays generic",
err: saml.NewSAMLAutoSignupDisabledError(configID),
code: authErrorSAMLAutoSignupDisabled,
code: authErrorAuthenticationFailed,
ok: true,
},
{
name: "user inactive",
name: "user inactive stays generic",
err: saml.NewUserInactiveError(configID),
code: authErrorSAMLUserInactive,
code: authErrorAuthenticationFailed,
ok: true,
},
{
name: "subject already in use",
name: "subject already in use stays generic",
err: saml.NewSAMLSubjectAlreadyInUseError("assertion-1"),
code: authErrorSAMLSubjectAlreadyInUse,
code: authErrorAuthenticationFailed,
ok: true,
},
{
name: "invalid assertion maps to generic failure",
name: "invalid assertion stays generic",
err: saml.NewInvalidAssertionError("assertion-1", errors.New("bad signature")),
code: authErrorAuthenticationFailed,
ok: true,
},
{
name: "replay maps to generic failure",
name: "replay stays generic",
err: saml.NewReplayAttackDetectedError("assertion-1"),
code: authErrorAuthenticationFailed,
ok: true,