rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix cubic review

Browse Source 
Signed-off-by: Émile Ré <nemile.re@gmail.com>
This commit is contained in:
Émile Ré
2025-12-15 15:00:38 +01:00
parent 729551beac
commit 85e453ebcd
9 changed files with 66 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
pkg/auth/saml_mapper.go
View File

@@ -66,18 +66,6 @@ func ExtractEmailFromAssertion(assertion *saml.Assertion) (string, error) {
return "", fmt.Errorf("could not extract email from assertion")
}
func ExtractEmailDomain(email string) (string, error) {
parts := strings.Split(email, "@")
if len(parts) != 2 {
return "", fmt.Errorf("invalid email address: %s", email)
}
domain := strings.ToLower(strings.TrimSpace(parts[1]))
if domain == "" {
return "", fmt.Errorf("empty domain in email address: %s", email)
}
return domain, nil
}
func MapSAMLRoleToSystemRole(samlRole string) *coredata.MembershipRole {
if samlRole != "" && isValidRole(samlRole) {
role := coredata.MembershipRole(samlRole)
@@ -104,7 +92,7 @@ func ExtractUserAttributes(
if assertion.Subject != nil && assertion.Subject.NameID != nil {
email, err = mail.ParseAddr(assertion.Subject.NameID.Value)
if err != nil {
return mail.Nil, "", "", fmt.Errorf("invalid nameID as email address")
return mail.Nil, "", "", fmt.Errorf("invalid nameID as email address: %w", err)
}
fullname = email.String()
role = ""
@@ -123,7 +111,7 @@ func ExtractUserAttributes(
}
email, err = mail.ParseAddr(emailString)
if err != nil {
return mail.Nil, "", "", fmt.Errorf("invalid attribute email")
return mail.Nil, "", "", fmt.Errorf("invalid attribute email: %w", err)
}
firstname, err := ExtractAttributeValue(assertion, attributeFirstname)

3
pkg/auth/saml_service.go
View File

@@ -24,6 +24,7 @@ import (
"fmt"
"net/http"
"net/url"
"strings"
"time"
"github.com/crewjam/saml"
@@ -517,7 +518,7 @@ func (s *SAMLService) HandleSAMLAssertion(
return nil, ErrCannotExtractUserAttributes{Err: err}
}
if email.Domain() != config.EmailDomain {
if !strings.EqualFold(email.Domain(), config.EmailDomain) {
return nil, fmt.Errorf("email domain mismatch: assertion contains email with domain %s but SAML config is for domain %s", email.Domain(), config.EmailDomain)
}