hyperscale-stack / security / 38231797205

98%

push

github

test(saml): add an adversarial corpus, interoperability tests and integration guide

Release gate of the SAML Service Provider (#87):
- a pinned corpus of 359 signed adversarial responses, with a
  deterministic generator. Each entry pins the full refusal message or
  the exact identity, and a meta-test scanning the sources requires
  every refusal rule in some entry;
- crewjam/saml interoperability in CI: SP key rollover, two IdPs behind
  two connections, cross-tenant substitution;
- Keycloak 26.7.4: a live opt-in suite (K1-K7, digest-pinned compose)
  and, in CI, the replay of its captures, with XSW1-XSW8 applied to the
  Apache Santuario output;
- replay and atomic consumption raced across three SP instances on
  shared stores: SQLite file and miniredis in CI; PostgreSQL, MySQL and
  Redis opt-in;
- IdP metadata retrieval behind a connection: rollover, hung refreshes,
  time-driven fetches, entity pin, outbound refusals;
- an opt-in Tales browser suite (make e2e) against examples/saml-sp:
  cross-site POST correlation, cookie tossing, login CSRF, RelayState
  integrity, open redirects, the example's login gate;
- docs/saml-sp.md, the integration guide: trust tables, the identity key
  with the connection ID first, sessions, deployment, rollover runbooks,
  troubleshooting, evidence.

After the code review, the user decided that the lexical gate refuses XML
names that are not namespace-well-formed (an empty prefix or local part).

Opt-in runs on 2026-10-12, all passing: Keycloak 26.7.4 (16/16), the
PostgreSQL 16, MySQL 8.0 and Redis 7.4 races, and Tales with Chrome 154
(16 scenarios).

Refs #88.

7 of 7 new or added lines in 1 file covered. (100.0%)

12355 of 12685 relevant lines covered (97.4%)

1741.07 hits per line