Skip to content
Snippets Groups Projects
This project is mirrored from https://github.com/hdacloud/dex.git. Pull mirroring updated .
  1. Apr 04, 2017
    • Eric Chiang's avatar
      Merge pull request #894 from ericchiang/backport-saml-fix-v2.3.x · da60fa82
      Eric Chiang authored
      connector/saml: fix validation bug with multiple Assertion elements
      v2.3.1
      da60fa82
    • Eric Chiang's avatar
      connector/saml: refactor tests and add self-signed responses · 6a701489
      Eric Chiang authored
      Introduces SAML tests which execute full response processing and
      compare user attributes. tesdata now includes a full, self-signed
      CA and documents signed using xmlsec1.
      
      Adds deprication notices to existing tests, but don't remove them
      since they still provide coverage.
      6a701489
    • Eric Chiang's avatar
      connector/saml: fix validation bug with multiple Assertion elements · 59cefd98
      Eric Chiang authored
      When a SAML response provided multiple Assertion elements, only the
      first one is checked for a valid signature. If the Assertion is
      verified, the original Assertion is removed and the canonicalized
      version is prepended to the Response. However, if there were
      multiple assertions, the second assertion could end up first in the
      list of Assertions, even if it was unsigned.
      
      For example this:
      
          <Response>
            <!--
               Response unsigned. According to SAML spec must check
               assertion signature.
            -->
            <Assertion>
              <Signature>
                <!-- Correrctly signed assertion -->
              </Signature>
            </Assertion>
      
            <Assertion>
              <!-- Unsigned assertion inserted by attacker-->
            </Assertion>
          </Response>
      
      could be verified then re-ordered to the following:
      
          <Response>
            <!--
               Response unsigned. According to SAML spec must check
               assertion signature.
            -->
            <Assertion>
              <!-- Unsigned assertion inserted by attacker-->
            </Assertion>
      
            <Assertion>
              <!-- Canonicalized, correrctly signed assertion -->
            </Assertion>
          </Response>
      
      Fix this by removing all unverified child elements of the Response,
      not just the original assertion.
      59cefd98
  2. Mar 24, 2017
  3. Mar 23, 2017
  4. Mar 22, 2017
  5. Mar 21, 2017
  6. Mar 20, 2017
  7. Mar 17, 2017
  8. Mar 16, 2017
  9. Mar 15, 2017
  10. Mar 13, 2017
  11. Mar 10, 2017
  12. Mar 09, 2017
  13. Mar 08, 2017
Loading