Open-MSS / MSS / 42909443939

78%

Build Type

push

github

Committed by web-flow

Commit Message

Link SAML logins to accounts by a persistent identifier (#3308)

* Link SAML logins to accounts by a persistent identifier instead of the email, accept each SAML response once and harden the test identity provider

* Link older SAML accounts only for the IdP the login went to, fall back to the email for taken usernames and let msui log in by SAML to older servers

- an assertion without its own signature counts only with a signed response of the same IdP
- starting a SAML login needs the basic authentication of the server, as the password login
- an unconfirmed account gets a message, the code works again after the confirmation
- several accounts with the email in different case refuse the login instead of picking one
- a malformed code request gets 401 instead of 500, refused responses are logged with their reason

* Unlink SAML identities on a password reset, show server messages in msui as plain text and keep configured SAML endpoint paths

Coverage Stats

470 of 513 new or added lines in 10 files covered. (91.62%)

2 existing lines in 1 file now uncovered.

18484 of 23653 relevant lines covered (78.15%)

3.12 hits per line