Elgato_dark/fleet
1
0
Fork 0
mirror of https://github.com/fleetdm/fleet synced 2026-05-21 16:08:47 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 100

Added ability to handle nested signed assertions in SAML response

Browse source 
Closes #1532

Fixes error that was caused because there was a bug in processing nested assertions in a successful SAML response. This was not caught in the initial push of this code because the IDP's we tested against all sign the entire response document as opposed to parts of it.  Thus the existing test cases didn't cover the code that dealt with nested assertions.
This commit is contained in:
John Murphy 2017-07-18 15:28:35 -05:00 committed by GitHub
parent f05204b4dc
commit e67157345a
3 changed files with 85 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

15
server/sso/authorization_response_test.go
View file

File diff suppressed because one or more lines are too long

3
server/sso/validate.go
View file

@ -113,7 +113,7 @@ func (v *validator) ValidateSignature(auth kolide.Auth) (kolide.Auth, error) {
// We've verified that the response hasn't been tampered with at this point
signedDoc := etree.NewDocument()
signedDoc.SetRoot(signed)
buffer, err := doc.WriteToBytes()
buffer, err := signedDoc.WriteToBytes()
if err != nil {
return nil, errors.Wrap(err, "creating signed doc buffer")
}
@ -132,7 +132,6 @@ func (v *validator) validateSignature(elt *etree.Element) (*etree.Element, error
// If entire doc is signed, success, we're done.
return validated, nil
}
if err == dsig.ErrMissingSignature {
// If entire document is not signed find signed assertions, remove assertions
// that are not signed.

69
server/sso/validate_test.go
View file

File diff suppressed because one or more lines are too long