oxidecomputer / oxidecomputer/console
Add identity provider allows for empty values
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 228
- Forks
- 22
- Avg merge
- 19h 42m
- Merged PRs (30d)
- 32
Description
When adding an identity provider to a silo, the form does not check for empty values on non-optional fields. The only field that looks to be checked is the name field. Filling out the name only and clicking create will submit the following:
{
"type": "saml",
"name": "test",
"description": "",
"acs_url": "",
"idp_entity_id": "",
"slo_url": "",
"sp_client_id": "",
"technical_contact_email": "",
"idp_metadata_source": {
"type": "url",
"url": ""
}
}
This will fail on the server due to an invalid idp_metadata_source. But if you add a valid url or upload a valid XML metadata file, you will be allowed to create an IdP connection with entirely empty values (which breaks in all kinds of ways).
This is notably painful at the moment as we have neither update nor delete endpoints for IdPs.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the silo identity-provider creation form and reproduce the submission using only the name, then repeat with valid metadata and the other fields empty. Done means non-optional fields reject empty values before submission, and a valid metadata source cannot create an IdP connection with invalid empty settings.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- authentication, frontend
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100