sources/saml: move SAML Response signature verification before decryption#18176
Closed
ikob wants to merge 35 commits intogoauthentik:mainfrom
Closed
sources/saml: move SAML Response signature verification before decryption#18176ikob wants to merge 35 commits intogoauthentik:mainfrom
ikob wants to merge 35 commits intogoauthentik:mainfrom
Conversation
…ntik#17607 to version-2025.10) (goauthentik#17620) website: fix active menu link background overlap (goauthentik#17607) Co-authored-by: Dominic R <dominic@sdko.org>
…ion-2025.10) (goauthentik#17627) Co-authored-by: authentik-automation[bot] <135050075+authentik-automation[bot]@users.noreply.github.com>
…y-pick goauthentik#17625 to version-2025.10) (goauthentik#17626) ci: use forked release action to deal with large release notes (goauthentik#17625) * ci: use forked release action to deal with large release notes * bump build --------- Signed-off-by: Jens Langhammer <jens@goauthentik.io> Co-authored-by: Jens L. <jens@goauthentik.io>
…ry-pick goauthentik#17606 to version-2025.10) (goauthentik#17637) enterprise: add prometheus metrics for license usage and expiry (goauthentik#17606) Signed-off-by: Jens Langhammer <jens@goauthentik.io> Co-authored-by: Jens L. <jens@goauthentik.io>
…y-pick goauthentik#17641 to version-2025.10) (goauthentik#17652) website/docs: rel notes 2025.10: add 3 more integration guides (goauthentik#17641) * add 3 more int guides * Apply suggestion from @dominic-r * is github's suggestion thingy usually this buggy --------- Signed-off-by: Dominic R <dominic@sdko.org> Co-authored-by: Tana M Berry <tanamarieberry@yahoo.com> Co-authored-by: Tana M Berry <tana@goauthentik.io> Co-authored-by: Dominic R <dominic@sdko.org>
…ik#17650 to version-2025.10) (goauthentik#17651) providers/proxy: drop headers with underscores (goauthentik#17650) drop any headers with underscores that we set in the remote system Signed-off-by: Jens Langhammer <jens@goauthentik.io> Co-authored-by: Jens L. <jens@goauthentik.io>
…hentik#17657 to version-2025.10) (goauthentik#17672) website/docs: add note about invite link not bound (goauthentik#17657) * invite link not bound * marcelo's truth * jens tweak --------- Co-authored-by: Tana M Berry <tanamarieberry@yahoo.com> Co-authored-by: Tana M Berry <tana@goauthentik.io>
…hentik#17642 to version-2025.10) (goauthentik#17699) website/docs: eap add info about custom validation (goauthentik#17642) * add info about custom validation * tweaked table * remove bullet * remove other bullet --------- Co-authored-by: Tana M Berry <tanamarieberry@yahoo.com> Co-authored-by: Tana M Berry <tana@goauthentik.io>
…ntik#17700 to version-2025.10) (goauthentik#17701) Co-authored-by: Dominic R <dominic@sdko.org>
…oauthentik#17628 to version-2025.10) (goauthentik#17633) website/docs: add short-lived certificate recommendation (goauthentik#17628) Add certificate recommendation Co-authored-by: Dewi Roberts <dewi@goauthentik.io>
…k#17704 to version-2025.10) (goauthentik#17708) website/docs: blueprints: add a bit more info (goauthentik#17704) * website/docs: blueprints: add a bit more info * this might be worth mentioning * fix * a bit more info Co-authored-by: Dominic R <dominic@sdko.org>
… to version-2025.10) (goauthentik#17730) enterprise: handle cached naive timezone (goauthentik#17695) Signed-off-by: Jens Langhammer <jens@goauthentik.io> Co-authored-by: Jens L. <jens@goauthentik.io>
…to version-2025.10) (goauthentik#17732) website/docs: update flow context ref (goauthentik#17723) * website/docs: update flow context ref * format * Update website/docs/add-secure-apps/flows-stages/flow/context/index.mdx * Update website/docs/add-secure-apps/flows-stages/flow/context/index.mdx --------- Signed-off-by: Jens Langhammer <jens@goauthentik.io> Signed-off-by: Jens L. <jens@beryju.org> Co-authored-by: Jens L. <jens@goauthentik.io> Co-authored-by: Dominic R <dominic@sdko.org> Co-authored-by: Tana M Berry <tanamarieberry@yahoo.com>
…#17728 to version-2025.10) (goauthentik#17733) website/docs: finalise 2025.10 release notes (goauthentik#17728) * website/docs: finalise 2025.10 release notes * format --------- Signed-off-by: Jens Langhammer <jens@goauthentik.io> Co-authored-by: Jens L. <jens@goauthentik.io>
Sync. upstream.
✅ Deploy Preview for authentik-docs ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
✅ Deploy Preview for authentik-storybook ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
✅ Deploy Preview for authentik-integrations ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #18176 +/- ##
==========================================
- Coverage 93.37% 93.11% -0.27%
==========================================
Files 950 950
Lines 52229 52271 +42
==========================================
- Hits 48771 48673 -98
- Misses 3458 3598 +140
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. |
PeshekDotDev
requested changes
Dec 2, 2025
Contributor
PeshekDotDev
left a comment
There was a problem hiding this comment.
Can you also add a couple comments just saying "This is the fallback verification", etc?
Really appreciate you getting to this @ikob
We need some more test fixtures for fixing it. Co-authored-by: Connor Peshek <connor@connorpeshek.me> Signed-off-by: Katsushi Kobayashi <ikob@acm.org>
…ion-2025.10) (goauthentik#17627) Co-authored-by: authentik-automation[bot] <135050075+authentik-automation[bot]@users.noreply.github.com>
Signed-off-by: Katsushi Kobayashi <ikob@acm.org>
Contributor
Author
|
@rissson @PeshekDotDev anything we can do to advance this further? |
|
any update about that? |
|
Is fixing google login with signed callbacks no priority, or is there anything controversial about this PR? |
Contributor
|
Hey everyone, I have made a different version of this PR that is more in line with our engineering style. I appreciate everyone's patience, and if there are any questions — or especially if there are any other saml source/provider related issues you all have found — please let me know. I am committed to getting our SAML experience as nice as possible Thank you Alternate PR — #19593 |
6 tasks
Contributor
Author
|
@PeshekDotDev, |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Details
When a SAML Response is encrypted, signature verification may fail because it is performed after decryption, when the original signed structure has changed.
This PR moves the verification step for signed responses to before decryption to handle encrypted signed responses correctly.
For backward compatibility, the post-decryption check remains as a fallback.
Hopefully close 405 errors at the step 4 of #16627
Checklist
ak test authentik/)make lint-fix)If an API change has been made
make gen-build)If changes to the frontend have been made
make web)If applicable
make docs)