zitadel/internal/idp/providers
Livio Spring ffe9570776
fix(saml): improve error handling (#8928)
# Which Problems Are Solved

There are multiple issues with the metadata and error handling of SAML:
- When providing a SAML metadata for an IdP, which cannot be processed,
the error will only be noticed once a user tries to use the IdP.
- Parsing for metadata with any other encoding than UTF-8 fails.
- Metadata containing an enclosing EntitiesDescriptor around
EntityDescriptor cannot be parsed.
- Metadata's `validUntil` value is always set to 48 hours, which causes
issues on external providers, if processed from a manual down/upload.
- If a SAML response cannot be parsed, only a generic "Authentication
failed" error is returned, the cause is hidden to the user and also to
actions.

# How the Problems Are Solved

- Return parsing errors after create / update and retrieval of an IdP in
the API.
- Prevent the creation and update of an IdP in case of a parsing
failure.
- Added decoders for encodings other than UTF-8 (including ASCII,
windows and ISO, [currently
supported](efd25daf28/encoding/ianaindex/ianaindex.go (L156)))
- Updated parsing to handle both `EntitiesDescriptor` and
`EntityDescriptor` as root element
- `validUntil` will automatically set to the certificate's expiration
time
- Unwrapped the hidden error to be returned. The Login UI will still
only provide a mostly generic error, but action can now access the
underlying error.

# Additional Changes

None

# Additional Context

reported by a customer
2024-12-03 10:38:28 +00:00
..
apple fix: improve secret generation for apple idp (#7843) 2024-04-26 15:46:15 +00:00
azuread fix(idp): provide id_token for tenant id based azure ad (#7188) 2024-01-10 15:02:17 +00:00
github merge main into next 2023-10-19 12:34:00 +02:00
gitlab merge main into next 2023-10-19 12:34:00 +02:00
google merge main into next 2023-10-19 12:34:00 +02:00
jwt chore(deps): update all go deps (#7773) 2024-04-15 09:17:36 +00:00
ldap fix: encode ldap values to make valid UTF8 (#8210) 2024-06-28 13:46:54 +00:00
oauth fix: improve login_hint usage on IDPs (#6899) 2023-11-13 09:25:26 +01:00
oidc chore(deps): update all go deps (#7773) 2024-04-15 09:17:36 +00:00
saml fix(saml): improve error handling (#8928) 2024-12-03 10:38:28 +00:00