Damans227 opened a new pull request, #14332: URL: https://github.com/apache/cloudstack/pull/14332
The SAML2 user authenticator lets any SAML2 user in without checking a password. Today the normal username and password login turns SAML2 users away before they get there, so that one check is all that stands in the way. This makes the authenticator say yes only when the SAML login or the SAML account switch is driving the login, after the IdP response or the current session has already been checked. Any other login for a SAML2 user is refused. The check on the normal login stays as it is. Original change by @mprokopchuk. ### Test: New unit tests in SAML2UserAuthenticatorTest: the login goes through when the SAML flow marked it, and is refused when it did not, after the mark is cleared, and on an empty password. All 42 tests in the saml2 plugin pass on 4.22. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
