mirror of
https://github.com/zitadel/zitadel.git
synced 2025-07-11 13:58:30 +00:00
fix(SAML): check on empty nameID (#8714)
# Which Problems Are Solved If a SAML IdP did not send a `NameID` (even though required by the specification), ZITADEL would crash. # How the Problems Are Solved - Check specifically if the `Subject` and its `NameID` is passed # Additional Changes None # Additional Context - closes https://github.com/zitadel/zitadel/issues/8654
This commit is contained in:
parent
be53caafea
commit
18499274dd
@ -70,6 +70,10 @@ func (s *Session) FetchUser(ctx context.Context) (user idp.User, err error) {
|
|||||||
return nil, zerrors.ThrowInvalidArgument(err, "SAML-nuo0vphhh9", "Errors.Intent.ResponseInvalid")
|
return nil, zerrors.ThrowInvalidArgument(err, "SAML-nuo0vphhh9", "Errors.Intent.ResponseInvalid")
|
||||||
}
|
}
|
||||||
|
|
||||||
|
// nameID is required, but at least in ADFS it will not be sent unless explicitly configured
|
||||||
|
if s.Assertion.Subject == nil || s.Assertion.Subject.NameID == nil {
|
||||||
|
return nil, zerrors.ThrowInvalidArgument(err, "SAML-EFG32", "Errors.Intent.ResponseInvalid")
|
||||||
|
}
|
||||||
nameID := s.Assertion.Subject.NameID
|
nameID := s.Assertion.Subject.NameID
|
||||||
userMapper := NewUser()
|
userMapper := NewUser()
|
||||||
// use the nameID as default mapping id
|
// use the nameID as default mapping id
|
||||||
|
File diff suppressed because one or more lines are too long
Loading…
x
Reference in New Issue
Block a user