rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Cover magic-link and SAML failures on auth error page

Browse Source 
Browser auth callbacks still returned JSON or used one-off pages
for several refusal reasons. Route OIDC email verification,
magic-link, and SAML ACS failures through /auth/error with stable
error codes so users always see an explanation.

Signed-off-by: Cursor Agent <cursoragent@cursor.com>

Co-authored-by: Bryan FRIMIN <bryan@frimin.fr>
This commit is contained in:
Bryan Frimin
2026-07-24 21:32:56 +00:00
committed by Cursor Agent
parent 68e78a2230
commit 318789ec38
8 changed files with 223 additions and 143 deletions
Download Patch File Download Diff File Expand all files Collapse all files

49
pkg/server/api/connect/v1/auth_error.go
View File

@@ -21,13 +21,26 @@
package connect_v1
import (
"errors"
"net/http"
"net/url"
"go.probo.inc/probo/pkg/iam/saml"
)
const (
authErrorPersonalAccountNotAllowed = "personal_account_not_allowed"
authErrorEmailNotVerified = "email_not_verified"
authErrorAuthenticationFailed = "authentication_failed"
authErrorMagicLinkExpired = "magic_link_expired"
authErrorMagicLinkAlreadyUsed = "magic_link_already_used"
authErrorMagicLinkInvalid = "magic_link_invalid"
authErrorSAMLDisabled = "saml_disabled"
authErrorSAMLConfigurationNotFound = "saml_configuration_not_found"
authErrorSAMLEmailDomainMismatch = "saml_email_domain_mismatch"
authErrorSAMLAutoSignupDisabled = "saml_auto_signup_disabled"
authErrorSAMLUserInactive = "saml_user_inactive"
authErrorSAMLSubjectAlreadyInUse = "saml_subject_already_in_use"
)
func redirectAuthError(w http.ResponseWriter, r *http.Request, code string) {
@@ -41,3 +54,39 @@ func redirectAuthError(w http.ResponseWriter, r *http.Request, code string) {
http.Redirect(w, r, redirectURL.String(), http.StatusFound)
}
func authErrorCodeFromSAML(err error) (string, bool) {
if _, ok := errors.AsType[*saml.ErrSAMLDisabled](err); ok {
return authErrorSAMLDisabled, true
}
if _, ok := errors.AsType[*saml.ErrSAMLConfigurationNotFound](err); ok {
return authErrorSAMLConfigurationNotFound, true
}
if _, ok := errors.AsType[*saml.ErrEmailDomainMismatch](err); ok {
return authErrorSAMLEmailDomainMismatch, true
}
if _, ok := errors.AsType[*saml.ErrSAMLAutoSignupDisabled](err); ok {
return authErrorSAMLAutoSignupDisabled, true
}
if _, ok := errors.AsType[*saml.ErrUserInactive](err); ok {
return authErrorSAMLUserInactive, true
}
if _, ok := errors.AsType[*saml.ErrSAMLSubjectAlreadyInUse](err); ok {
return authErrorSAMLSubjectAlreadyInUse, true
}
if _, ok := errors.AsType[*saml.ErrInvalidAssertion](err); ok {
return authErrorAuthenticationFailed, true
}
if _, ok := errors.AsType[*saml.ErrReplayAttackDetected](err); ok {
return authErrorAuthenticationFailed, true
}
return "", false
}

87
pkg/server/api/connect/v1/auth_error_test.go
View File

@@ -21,12 +21,17 @@
package connect_v1
import (
"errors"
"net/http"
"net/http/httptest"
"testing"
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
"go.probo.inc/probo/pkg/coredata"
"go.probo.inc/probo/pkg/gid"
"go.probo.inc/probo/pkg/iam/saml"
"go.probo.inc/probo/pkg/mail"
)
func TestRedirectAuthError(t *testing.T) {
@@ -43,3 +48,85 @@ func TestRedirectAuthError(t *testing.T) {
assert.Equal(t, "/auth/error", location.Path)
assert.Equal(t, authErrorPersonalAccountNotAllowed, location.Query().Get("error"))
}
func TestAuthErrorCodeFromSAML(t *testing.T) {
t.Parallel()
configID := gid.New(gid.TenantID(1), coredata.SAMLConfigurationEntityType)
email, err := mail.ParseAddr("user@example.com")
require.NoError(t, err)
tests := []struct {
name string
err error
code string
ok bool
}{
{
name: "disabled",
err: saml.NewSAMLDisabledError(),
code: authErrorSAMLDisabled,
ok: true,
},
{
name: "configuration not found",
err: saml.NewSAMLConfigurationNotFoundError(configID),
code: authErrorSAMLConfigurationNotFound,
ok: true,
},
{
name: "email domain mismatch",
err: saml.NewEmailDomainMismatchError(email, "acme.com"),
code: authErrorSAMLEmailDomainMismatch,
ok: true,
},
{
name: "auto signup disabled",
err: saml.NewSAMLAutoSignupDisabledError(configID),
code: authErrorSAMLAutoSignupDisabled,
ok: true,
},
{
name: "user inactive",
err: saml.NewUserInactiveError(configID),
code: authErrorSAMLUserInactive,
ok: true,
},
{
name: "subject already in use",
err: saml.NewSAMLSubjectAlreadyInUseError("assertion-1"),
code: authErrorSAMLSubjectAlreadyInUse,
ok: true,
},
{
name: "invalid assertion maps to generic failure",
err: saml.NewInvalidAssertionError("assertion-1", errors.New("bad signature")),
code: authErrorAuthenticationFailed,
ok: true,
},
{
name: "replay maps to generic failure",
err: saml.NewReplayAttackDetectedError("assertion-1"),
code: authErrorAuthenticationFailed,
ok: true,
},
{
name: "unknown error",
err: errors.New("boom"),
ok: false,
},
}
for _, tt := range tests {
t.Run(
tt.name,
func(t *testing.T) {
t.Parallel()
code, ok := authErrorCodeFromSAML(tt.err)
assert.Equal(t, tt.ok, ok)
assert.Equal(t, tt.code, code)
},
)
}
}

17
pkg/server/api/connect/v1/oidc_handler.go
View File

@@ -138,6 +138,13 @@ func (h *OIDCHandler) CallbackHandler(w http.ResponseWriter, r *http.Request) {
return
}
if _, ok := errors.AsType[*oidc.ErrEmailNotVerified](err); ok {
h.logger.WarnCtx(ctx, "OIDC login rejected: email not verified")
redirectAuthError(w, r, authErrorEmailNotVerified)
return
}
h.logger.ErrorCtx(ctx, "cannot handle OIDC callback", log.Error(err))
redirectAuthError(w, r, authErrorAuthenticationFailed)
@@ -301,29 +308,29 @@ func (h *MagicLinkHandler) VerifyHandler(w http.ResponseWriter, r *http.Request)
token := r.URL.Query().Get("token")
if token == "" {
httpserver.RenderError(w, http.StatusBadRequest, errors.New("missing token"))
redirectAuthError(w, r, authErrorMagicLinkInvalid)
return
}
identity, session, continueURL, err := h.iam.AuthService.OpenSessionWithMagicLink(ctx, token)
if err != nil {
if _, ok := errors.AsType[*iam.ErrExpiredToken](err); ok {
http.Redirect(w, r, "/auth/magic-link-expired", http.StatusFound)
redirectAuthError(w, r, authErrorMagicLinkExpired)
return
}
if _, ok := errors.AsType[*iam.ErrTokenAlreadyUsed](err); ok {
http.Redirect(w, r, "/auth/magic-link-already-used", http.StatusFound)
redirectAuthError(w, r, authErrorMagicLinkAlreadyUsed)
return
}
if _, ok := errors.AsType[*iam.ErrInvalidToken](err); ok {
httpserver.RenderError(w, http.StatusBadRequest, errors.New("invalid token"))
redirectAuthError(w, r, authErrorMagicLinkInvalid)
return
}
h.logger.ErrorCtx(ctx, "cannot open session with magic link", log.Error(err))
httpserver.RenderError(w, http.StatusInternalServerError, errors.New("internal server error"))
redirectAuthError(w, r, authErrorAuthenticationFailed)
return
}

45
pkg/server/api/connect/v1/saml_handler.go
View File

@@ -32,7 +32,6 @@ import (
"go.probo.inc/probo/pkg/baseurl"
"go.probo.inc/probo/pkg/gid"
"go.probo.inc/probo/pkg/iam"
"go.probo.inc/probo/pkg/iam/saml"
"go.probo.inc/probo/pkg/saferedirect"
"go.probo.inc/probo/pkg/securecookie"
"go.probo.inc/probo/pkg/server/api/authn"
@@ -61,49 +60,15 @@ func (h *SAMLHandler) renderInternalServerError(w http.ResponseWriter) {
}
func (h *SAMLHandler) renderAssertionError(w http.ResponseWriter, r *http.Request, err error) {
if isClientSAMLError(err) {
httpserver.RenderError(w, http.StatusUnauthorized, err)
if code, ok := authErrorCodeFromSAML(err); ok {
h.logger.WarnCtx(r.Context(), "SAML login rejected", log.Error(err), log.String("error_code", code))
redirectAuthError(w, r, code)
return
}
h.logger.ErrorCtx(r.Context(), "cannot handle SAML assertion", log.Error(err))
httpserver.RenderError(w, http.StatusUnauthorized, errors.New("authentication failed"))
}
func isClientSAMLError(err error) bool {
if _, ok := errors.AsType[*saml.ErrSAMLConfigurationNotFound](err); ok {
return true
}
if _, ok := errors.AsType[*saml.ErrSAMLDisabled](err); ok {
return true
}
if _, ok := errors.AsType[*saml.ErrInvalidAssertion](err); ok {
return true
}
if _, ok := errors.AsType[*saml.ErrReplayAttackDetected](err); ok {
return true
}
if _, ok := errors.AsType[*saml.ErrEmailDomainMismatch](err); ok {
return true
}
if _, ok := errors.AsType[*saml.ErrSAMLAutoSignupDisabled](err); ok {
return true
}
if _, ok := errors.AsType[*saml.ErrUserInactive](err); ok {
return true
}
if _, ok := errors.AsType[*saml.ErrSAMLSubjectAlreadyInUse](err); ok {
return true
}
return false
redirectAuthError(w, r, authErrorAuthenticationFailed)
}
func (h *SAMLHandler) MetadataHandler(w http.ResponseWriter, r *http.Request) {