rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix missing child session on SAML

Browse Source 
Signed-off-by: Bryan Frimin <bryan@getprobo.com>
This commit is contained in:
Bryan Frimin
2025-12-24 15:20:06 +01:00
parent 41a6df9aec
commit 3e95c8c38a
9 changed files with 69 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
pkg/iam/saml/service.go
View File

@@ -284,7 +284,9 @@ func (s *Service) HandleAssertion(
}
}
err = membership.LoadByIdentityAndOrg(ctx, tx, coredata.NewNoScope(), identity.ID, config.OrganizationID)
scope := coredata.NewScopeFromObjectID(config.OrganizationID)
err = membership.LoadByIdentityAndOrg(ctx, tx, scope, identity.ID, config.OrganizationID)
if err != nil && err != coredata.ErrResourceNotFound {
return fmt.Errorf("cannot load membership: %w", err)
}
@@ -300,7 +302,7 @@ func (s *Service) HandleAssertion(
UpdatedAt: now,
}
err = membership.Insert(ctx, tx, coredata.NewNoScope())
err = membership.Insert(ctx, tx, scope)
if err != nil {
return fmt.Errorf("cannot insert membership: %w", err)
}
@@ -323,21 +325,21 @@ func (s *Service) HandleAssertion(
membership.Role = *role
membership.UpdatedAt = now
err = membership.Update(ctx, tx, coredata.NewNoScope())
err = membership.Update(ctx, tx, scope)
if err != nil {
return fmt.Errorf("cannot update membership: %w", err)
}
}
memberProfile := &coredata.MembershipProfile{}
err = memberProfile.LoadByMembershipID(ctx, tx, coredata.NewNoScope(), membership.ID)
err = memberProfile.LoadByMembershipID(ctx, tx, scope, membership.ID)
if err != nil {
return fmt.Errorf("cannot load membership profile: %w", err)
}
memberProfile.FullName = fullname
memberProfile.UpdatedAt = now
err = memberProfile.Update(ctx, tx, coredata.NewNoScope())
err = memberProfile.Update(ctx, tx, scope)
if err != nil {
return fmt.Errorf("cannot update membership profile: %w", err)
}

22
pkg/iam/session_service.go
View File

@@ -374,15 +374,19 @@ func (s SessionService) AssumeOrganizationSession(
}
if err == nil && samlConfig.EnforcementPolicy == coredata.SAMLEnforcementPolicyRequired {
redirectURL, err := s.SAMLService.InitiateLogin(ctx, samlConfig.ID)
if err != nil {
return fmt.Errorf("cannot initiate SAML login: %w", err)
if rootSession.AuthMethod != coredata.AuthMethodSAML {
redirectURL, err := s.SAMLService.InitiateLogin(ctx, samlConfig.ID)
if err != nil {
return fmt.Errorf("cannot initiate SAML login: %w", err)
}
return NewSAMLAuthenticationRequiredError("policy_requirement", redirectURL.String())
}
return NewSAMLAuthenticationRequiredError("policy_requirement", redirectURL.String())
}
if rootSession.AuthMethod != coredata.AuthMethodPassword {
} else if err == nil && samlConfig.EnforcementPolicy == coredata.SAMLEnforcementPolicyOptional {
// SAML is optional: both PASSWORD and SAML root sessions are allowed.
} else if rootSession.AuthMethod != coredata.AuthMethodPassword {
// No (or non-required) SAML configuration: require a password-authenticated root session
// (eg. when switching into a password-based org from a SAML login).
return NewPasswordRequiredError("password_authentication_required")
}
@@ -393,7 +397,7 @@ func (s SessionService) AssumeOrganizationSession(
TenantID: &tenantID,
MembershipID: &membership.ID,
ParentSessionID: &rootSession.ID,
AuthMethod: coredata.AuthMethodPassword,
AuthMethod: rootSession.AuthMethod,
AuthenticatedAt: now,
ExpiredAt: rootSession.ExpiredAt,
CreatedAt: now,