Skip to content
Projects
Groups
Snippets
Help
Loading...
Sign in
Toggle navigation
D
dex
Project
Project
Details
Activity
Cycle Analytics
Repository
Repository
Files
Commits
Branches
Tags
Contributors
Graph
Compare
Charts
Issues
0
Issues
0
List
Board
Labels
Milestones
Merge Requests
0
Merge Requests
0
Wiki
Wiki
Snippets
Snippets
Members
Members
Collapse sidebar
Close sidebar
Activity
Graph
Charts
Create a new issue
Commits
Issue Boards
Open sidebar
go
dex
Commits
47897f73
Commit
47897f73
authored
Apr 06, 2017
by
Phu Kieu
Browse files
Options
Browse Files
Download
Email Patches
Plain Diff
Validate audience with entityIssuer if present, use redirectURI otherwise
parent
40f0265a
Show whitespace changes
Inline
Side-by-side
Showing
2 changed files
with
8 additions
and
2 deletions
+8
-2
saml-connector.md
Documentation/saml-connector.md
+2
-0
saml.go
connector/saml/saml.go
+6
-2
No files found.
Documentation/saml-connector.md
View file @
47897f73
...
@@ -40,6 +40,8 @@ connectors:
...
@@ -40,6 +40,8 @@ connectors:
# insecureSkipSignatureValidation: true
# insecureSkipSignatureValidation: true
# Optional: Issuer value for AuthnRequest
# Optional: Issuer value for AuthnRequest
# Must be contained within the "AudienceRestriction" attribute in all responses
# If not set, redirectURI will be used for audience validation
entityIssuer
:
https://dex.example.com/callback
entityIssuer
:
https://dex.example.com/callback
# Optional: Issuer value for SAML Response
# Optional: Issuer value for SAML Response
...
...
connector/saml/saml.go
View file @
47897f73
...
@@ -466,6 +466,10 @@ func (p *provider) validateConditions(assertion *assertion) error {
...
@@ -466,6 +466,10 @@ func (p *provider) validateConditions(assertion *assertion) error {
}
}
}
}
// Validates audience
// Validates audience
audienceValue
:=
p
.
entityIssuer
if
audienceValue
==
""
{
audienceValue
=
p
.
redirectURI
}
audienceRestriction
:=
conditions
.
AudienceRestriction
audienceRestriction
:=
conditions
.
AudienceRestriction
if
audienceRestriction
!=
nil
{
if
audienceRestriction
!=
nil
{
audiences
:=
audienceRestriction
.
Audiences
audiences
:=
audienceRestriction
.
Audiences
...
@@ -473,14 +477,14 @@ func (p *provider) validateConditions(assertion *assertion) error {
...
@@ -473,14 +477,14 @@ func (p *provider) validateConditions(assertion *assertion) error {
values
:=
make
([]
string
,
len
(
audiences
))
values
:=
make
([]
string
,
len
(
audiences
))
issuerInAudiences
:=
false
issuerInAudiences
:=
false
for
i
,
audience
:=
range
audiences
{
for
i
,
audience
:=
range
audiences
{
if
audience
.
Value
==
p
.
redirectURI
{
if
audience
.
Value
==
audienceValue
{
issuerInAudiences
=
true
issuerInAudiences
=
true
break
break
}
}
values
[
i
]
=
audience
.
Value
values
[
i
]
=
audience
.
Value
}
}
if
!
issuerInAudiences
{
if
!
issuerInAudiences
{
return
fmt
.
Errorf
(
"required audience %s was not in Response audiences %s"
,
p
.
redirectURI
,
values
)
return
fmt
.
Errorf
(
"required audience %s was not in Response audiences %s"
,
audienceValue
,
values
)
}
}
}
}
}
}
...
...
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment