oxidecomputer / oxidecomputer/console

Add identity provider allows for empty values

Open
#2,138 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
TypeScript
Stars
228
Forks
22
Avg merge
19h 42m
Merged PRs (30d)
32

Description

When adding an identity provider to a silo, the form does not check for empty values on non-optional fields. The only field that looks to be checked is the name field. Filling out the name only and clicking create will submit the following:

{
  "type": "saml",
  "name": "test",
  "description": "",
  "acs_url": "",
  "idp_entity_id": "",
  "slo_url": "",
  "sp_client_id": "",
  "technical_contact_email": "",
  "idp_metadata_source": {
    "type": "url",
    "url": ""
  }
}

This will fail on the server due to an invalid idp_metadata_source. But if you add a valid url or upload a valid XML metadata file, you will be allowed to create an IdP connection with entirely empty values (which breaks in all kinds of ways).

This is notably painful at the moment as we have neither update nor delete endpoints for IdPs.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the silo identity-provider creation form and reproduce the submission using only the name, then repeat with valid metadata and the other fields empty. Done means non-optional fields reject empty values before submission, and a valid metadata source cannot create an IdP connection with invalid empty settings.

Written by the indexing model from the issue text.

Assessment

Tech stack
typescript
Domain
authentication, frontend
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.