rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Implement redirect path for SAML SSO

Browse Source 
Signed-off-by: Émile Ré <emile@getprobo.com>
This commit is contained in:
Émile Ré
2026-02-11 19:28:33 +04:00
parent 0544daa3ef
commit 16556f9fb9
3 changed files with 7 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
pkg/gid/gid.go
View File

@@ -19,6 +19,8 @@ type (
var ( var (
Nil = GID{} Nil = GID{}
EncodedGIDSize = base64.RawURLEncoding.EncodedLen(GIDSize)
) )
// ParseGID parses a string representation of a GID // ParseGID parses a string representation of a GID

6
pkg/iam/saml/service.go
View File

@@ -153,11 +153,9 @@ func (s *Service) InitiateLogin(
return fmt.Errorf("cannot insert SAML request: %w", err) return fmt.Errorf("cannot insert SAML request: %w", err)
} }
relayState := url.Values{} relayState := config.ID.String() + redirectPath
relayState.Add("config-id", config.ID.String())
relayState.Add("redirect-path", redirectPath)
redirect, err = req.Redirect(url.QueryEscape(relayState.Encode()), sp) redirect, err = req.Redirect(relayState, sp)
if err != nil { if err != nil {
return fmt.Errorf("cannot generate redirect URL: %w", err) return fmt.Errorf("cannot generate redirect URL: %w", err)
} }

8
pkg/server/api/connect/v1/saml_handler.go
View File

@@ -4,7 +4,6 @@ import (
"errors" "errors"
"fmt" "fmt"
"net/http" "net/http"
"net/url"
"github.com/go-chi/chi/v5" "github.com/go-chi/chi/v5"
"go.gearno.de/kit/httpserver" "go.gearno.de/kit/httpserver"
@@ -59,13 +58,12 @@ func (h *SAMLHandler) ConsumeHandler(w http.ResponseWriter, r *http.Request) {
samlResponse := r.FormValue("SAMLResponse") samlResponse := r.FormValue("SAMLResponse")
relayState := r.FormValue("RelayState") relayState := r.FormValue("RelayState")
values, err := url.ParseQuery(relayState) if len(relayState) < gid.EncodedGIDSize {
if err != nil {
httpserver.RenderError(w, http.StatusBadRequest, errors.New("invalid relay state")) httpserver.RenderError(w, http.StatusBadRequest, errors.New("invalid relay state"))
return return
} }
configIDStr := values.Get("config-id") configIDStr := relayState[:gid.EncodedGIDSize+1]
if configIDStr == "" { if configIDStr == "" {
httpserver.RenderError(w, http.StatusBadRequest, errors.New("missing config ID")) httpserver.RenderError(w, http.StatusBadRequest, errors.New("missing config ID"))
return return
@@ -77,7 +75,7 @@ func (h *SAMLHandler) ConsumeHandler(w http.ResponseWriter, r *http.Request) {
return return
} }
redirectPath := values.Get("redirect-path") redirectPath := relayState[gid.EncodedGIDSize+1:]
user, membership, err := h.iam.SAMLService.HandleAssertion(ctx, samlResponse, configID) user, membership, err := h.iam.SAMLService.HandleAssertion(ctx, samlResponse, configID)
if err != nil { if err != nil {