Elgato_dark/fleet
1
0
Fork 0
mirror of https://github.com/fleetdm/fleet synced 2026-05-23 08:58:41 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 111

Invalid SSO metadata now generates 400 error instead of 500 (#14903)

Browse source 
/fleet/sso endpoint now returns 400 status code (as opposed to 500) when
SSO Metadata URL returns invalid data or SSO Metadata is invalid

#12559

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/` or
`orbit/changes/`.
See [Changes
files](https://fleetdm.com/docs/contributing/committing-changes#changes-files)
for more information.
- [x] Added/updated tests
- [x] Manual QA for all new/changed functionality
This commit is contained in:
Victor Lyuboslavsky 2023-11-03 09:33:25 -05:00 committed by GitHub
parent bdb2c4c5b7
commit 776a6143a2
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
3 changed files with 57 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
changes/12559-sso-metadata-url Normal file
View file

@ -0,0 +1 @@
/fleet/sso endpoint now returns 400 status code (as opposed to 500) when SSO Metadata URL returns invalid data or when SSO Metadata provided by user is invalid.

55
server/service/integration_sso_test.go
View file

@ -83,6 +83,61 @@ func (s *integrationSSOTestSuite) TestGetSSOSettings() {
assert.True(t, strings.HasPrefix(authReq.ID, "id"), authReq.ID)
}
func (s *integrationSSOTestSuite) TestSSOInvalidMetadataURL() {
t := s.T()
badMetadataUrl := "https://www.fleetdm.com"
acResp := appConfigResponse{}
s.DoJSON(
"PATCH", "/api/latest/fleet/config", json.RawMessage(
`{
"sso_settings": {
"enable_sso": true,
"entity_id": "https://localhost:8080",
"issuer_uri": "http://localhost:8080/simplesaml/saml2/idp/SSOService.php",
"idp_name": "SimpleSAML",
"metadata_url": "`+badMetadataUrl+`",
"enable_jit_provisioning": false
}
}`,
), http.StatusOK, &acResp,
)
require.NotNil(t, acResp)
var resIni initiateSSOResponse
expectedStatus := http.StatusBadRequest
t.Logf("Expecting 400 %v status when bad SSO metadata_url is set: %v", expectedStatus, badMetadataUrl)
s.DoJSON("POST", "/api/v1/fleet/sso", map[string]string{}, expectedStatus, &resIni)
}
func (s *integrationSSOTestSuite) TestSSOInvalidMetadata() {
t := s.T()
badMetadata := "<EntityDescriptor>foo</EntityDescriptor>"
acResp := appConfigResponse{}
s.DoJSON(
"PATCH", "/api/latest/fleet/config", json.RawMessage(
`{
"sso_settings": {
"enable_sso": true,
"entity_id": "https://localhost:8080",
"issuer_uri": "http://localhost:8080/simplesaml/saml2/idp/SSOService.php",
"idp_name": "SimpleSAML",
"metadata": "`+badMetadata+`",
"metadata_url": "",
"enable_jit_provisioning": false
}
}`,
), http.StatusOK, &acResp,
)
require.NotNil(t, acResp)
var resIni initiateSSOResponse
expectedStatus := http.StatusBadRequest
t.Logf("Expecting %v status when bad SSO metadata is provided: %v", expectedStatus, badMetadata)
s.DoJSON("POST", "/api/v1/fleet/sso", map[string]string{}, expectedStatus, &resIni)
}
func (s *integrationSSOTestSuite) TestSSOValidation() {
acResp := appConfigResponse{}
// Test we are validating metadata_url

2
server/service/sessions.go
View file

@ -303,7 +303,7 @@ func (svc *Service) InitiateSSO(ctx context.Context, redirectURL string) (string
metadata, err := sso.GetMetadata(&appConfig.SSOSettings.SSOProviderSettings)
if err != nil {
return "", ctxerr.Wrap(ctx, err, "InitiateSSO getting metadata")
return "", ctxerr.Wrap(ctx, badRequestErr("Could not get SSO Metadata. Check your SSO settings.", err))
}
serverURL := appConfig.ServerSettings.ServerURL