Repository navigation
security(auth): SAML endpoints refuse every request until assertions are verified #866
Description
Problem (user terms)
The SAML endpoints are mounted on every deployment, including the many that never configured SAML. The assertion consumer service does not yet check assertions the way an identity-provider integration must. Until it does, it should refuse every request instead of opening sessions.
SAML sign-in has never been proven end to end (ROADMAP, module 2: "SAML2 : non prouvé live"), so no working flow is lost.
Tracked privately as GHSA-gp2h-chq2-gxx4. Details stay in the advisory until it is published.
Acceptance criteria
POST /api/v1/auth/saml2/acscreates no session and no user, whatever it receives. It redirects to/login?error=provider_not_configured&provider=saml2.GET /api/v1/auth/saml2/loginredirects to the same place instead of building an IdP request.- The code that turned an assertion into a user and a session is removed (
provisionSAML2User,applyGroupRoleMapping, the assertion structs), not left unreachable. GET /api/v1/auth/saml2/metadatais unchanged.- The README and docs stop presenting SAML2 as available.
- Tests: the ACS refuses a well-formed success response, refuses an empty body, and sets no session cookie. The login endpoint redirects.
Definition of done
go test ./... -count=1green,go vetclean.- The README and SAML docs match the code.
- PR with
Closes #<n>. - After the merge and release, the advisory is published with the patched version.
Out of scope
Real SAML support (a maintained library that verifies signed assertions). That needs an ADR and a dependency decision.
Activity
alex-dembele commentedon Oct 1, 2026
backend-go, 2026-10-01
Done
backend/internal/handler/saml2_handler.go: the ACS and the SAML login redirect to/login?error=provider_not_configured&provider=saml2and create nothing. The assertion-to-session code is removed (369 → 64 lines). The metadata endpoint is unchanged.saml2_handler_test.go.API_COMPLETE_ENDPOINTS.md,ENDPOINTS.md,API_SECURITY_GUIDE.mdandSAML_OAUTH2_INTEGRATION.mdupdated.Verified
go vet ./...: clean.go test ./... -count=1: 79 ok, 0 FAIL.saml2_handler.go; take fix(auth): SAML endpoints refuse every request until assertions are verified (#866) #868's side. The merged tree runs 79 ok, 0 FAIL.Criteria 1 ✅ · 2 ✅ · 3 ✅ · 4 ✅ · 5 ✅ for README and docs. The pricing and self-hosting plan tables are left to the owner. 6 ✅
Next
docs/DECISIONS.mdand open its issue once the advisory is public.Blocked on @owner: merge, and the pricing table wording.
Merge pull request #868 from opendefender/security/866-saml-fail-closed
fix(auth): restore the fail-closed SAML handler so master compiles (#886
Merge pull request #882 from opendefender/fix/881-saml-merge-build