cloudfoundry / cloudfoundry/uaa
Add option for SAML to validate or ignore invalid X509 Certificates
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 1.6k
- Forks
- 844
- Avg merge
- 2d 5h
- Merged PRs (30d)
- 27
Description
What version of UAA are you running?
Add option for SAML to allow or recject X509 certificates which are not valid (anymore).
How are you deploying the UAA?
I am deploying the UAA
- locally only using gradlew
- using a bosh release I downloaded from bosh.io
- using cf-release
- using cf-deployment
- as part of a commercial Cloud Foundry distribution
- other (please explain)
What did you do?
Setup various SAML integrations because of testing new SAML library.
Some IdP ignore expired X509, some not.
UAA (test UAA) has invalid certificate and with this the tests somethimes passed, sometimes not.
SAP SCI rejects
KeyCloak rejects
Okta? accepts
What did you expect to see? What goal are you trying to achieve with the UAA?
What did you see instead?
Please include UAA logs if available.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
The issue does not name a source file, test, or entry point. Begin by locating UAA's SAML X509 certificate validation path and its existing tests; done means defining and testing an explicit option for accepting or rejecting invalid certificates without weakening the default behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- authentication, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 20/100