shreemaan-abhishek opened a new pull request, #13964:
URL: https://github.com/apache/apisix/pull/13964
### Description
lua-resty-saml 0.2.6 checks more of a SAML login response and adds options
to configure those checks. This PR bumps the dependency and exposes the options
on `saml-auth`.
New optional attributes, each passed to the library unchanged:
| Attribute | Type | Behavior |
|---|---|---|
| `idp_issuers` | array[string] | Issuers accepted on a login response.
Unset accepts any issuer signed with `idp_cert`. An empty array accepts none. |
| `sp_acs_url` | string (`^https?://`) | Externally visible absolute ACS
URL, sent in the authentication request and matched against the response's
`Destination` and `Recipient`. Unset, it is built from the request's scheme,
host and `login_callback_uri`. |
| `sp_audiences` | array[string] | Accepted audiences. Unset means
`sp_issuer`. |
| `clock_skew` | number, >= 0 | Tolerated clock difference in seconds. Unset
means 60. |
| `replay_dict` | string, non-empty | Name of a declared `lua_shared_dict`
that records accepted assertions so one cannot log in twice on the same node.
Unset disables the record. |
| `replay_ttl` | number, >= 1 | Seconds to record an assertion that carries
no expiry. Unset means 600. |
None of them has a schema default, so the library's own defaults apply, and
an empty `idp_issuers` stays distinct from an unset one. Existing
configurations validate and behave as before.
Runtime changes:
- `resty.saml` keeps its options table by reference and reads it on every
request, so the plugin now passes `core.table.deepcopy(conf)` instead of the
plugin's own conf table.
- `resty_saml.new` raises on invalid options, for example a `replay_dict`
naming a dict that is not declared. The plugin now catches this and returns the
existing `500` with the reason logged.
Docs:
- The attribute table covers the new fields.
- `login_callback_uri`, `logout_uri` and `logout_callback_uri` are now
documented as request paths. The library compares them with the request path,
so the full URLs in the old example never matched.
- A new section covers issuer pinning, audiences, clock skew, `sp_acs_url`
behind a TLS-terminating or host-rewriting proxy, and declaring `replay_dict`
through `nginx_config.http.custom_lua_shared_dict`. It also explains that the
replay record is local to one node, how to size the dict, and that a repeated
submission is refused.
Tests:
- `t/plugin/saml-auth.t` adds schema cases for every field (valid, invalid,
omitted, empty `idp_issuers`), plus constructor cases.
- The constructor cases check that all six options reach the library
unchanged in a copied table, that changing the conf after caching leaves the
cached object unchanged, and that a failing constructor returns 500.
- One case confirms `resty.saml` is first loaded in `init_worker`, never
`init`.
- `t/plugin/saml-auth-options.t` runs against Keycloak:
- Login and logout work with every option set.
- Logins are refused for a wrong issuer, an empty `idp_issuers`, and a
wrong audience.
- The ACS URL is checked with and without `sp_acs_url` while the gateway
sees a rewritten `Host`.
- The same response is accepted twice without `replay_dict` and refused
the second time with it.
- An undeclared `replay_dict` returns 500.
#### Which issue(s) this PR fixes:
N/A
### Checklist
- [x] I have explained the need for this PR and the problem it solves
- [x] I have explained the changes or the new features added to this PR
- [x] I have added tests corresponding to this change
- [x] I have updated the documentation to reflect this change
- [x] I have verified that this change is backward compatible (If not,
please discuss on the [APISIX mailing
list](https://github.com/apache/apisix/tree/master#community) first)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
