Arsharth/dex
1
0
Fork 0
forked from mystiq/dex
Code Issues Pull requests Packages Projects Releases Wiki Activity

Merge pull request #896 from Calpicow/audience_validate_fix

Browse source 
Validate audience with entityIssuer if present, use redirectURI otherwise
This commit is contained in:
Eric Chiang 2017-04-06 14:47:05 -07:00 committed by GitHub
parent 40f0265ab4 47897f73fa
commit 53acaa9e7c
2 changed files with 8 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
Documentation/saml-connector.md
View file

@ -40,6 +40,8 @@ connectors:
# insecureSkipSignatureValidation: true # insecureSkipSignatureValidation: true
# Optional: Issuer value for AuthnRequest # Optional: Issuer value for AuthnRequest
# Must be contained within the "AudienceRestriction" attribute in all responses
# If not set, redirectURI will be used for audience validation
entityIssuer: https://dex.example.com/callback entityIssuer: https://dex.example.com/callback
# Optional: Issuer value for SAML Response # Optional: Issuer value for SAML Response

8
connector/saml/saml.go
View file

@ -466,6 +466,10 @@ func (p *provider) validateConditions(assertion *assertion) error {
} }
} }
// Validates audience // Validates audience
audienceValue := p.entityIssuer
if audienceValue == "" {
audienceValue = p.redirectURI
}
audienceRestriction := conditions.AudienceRestriction audienceRestriction := conditions.AudienceRestriction
if audienceRestriction != nil { if audienceRestriction != nil {
audiences := audienceRestriction.Audiences audiences := audienceRestriction.Audiences
@ -473,14 +477,14 @@ func (p *provider) validateConditions(assertion *assertion) error {
values := make([]string, len(audiences)) values := make([]string, len(audiences))
issuerInAudiences := false issuerInAudiences := false
for i, audience := range audiences { for i, audience := range audiences {
if audience.Value == p.redirectURI { if audience.Value == audienceValue {
issuerInAudiences = true issuerInAudiences = true
break break
} }
values[i] = audience.Value values[i] = audience.Value
} }
if !issuerInAudiences { if !issuerInAudiences {
return fmt.Errorf("required audience %s was not in Response audiences %s", p.redirectURI, values) return fmt.Errorf("required audience %s was not in Response audiences %s", audienceValue, values)
} }
} }
} }