mirror of
https://github.com/apache/cloudstack
synced 2026-09-03 01:49:06 +00:00
0459833631
When a SAML Response or EncryptedAssertion carries a ds:Signature element but the IdP metadata contains no signing certificate, the previous code silently skipped signature validation (the guard was `idpMetadata.getSigningCertificate() != null && sig != null`). An attacker could forge a SAMLResponse with an arbitrary bogus signature against a cert-less IdP and obtain a valid session — a full unauthenticated authentication bypass. Fix: when a signature IS present we now require a signing certificate to be registered. If none is found we immediately reject the request with an ACCOUNT_ERROR. The same guard is applied to the EncryptedAssertion signature block. |
||
|---|---|---|
| .. | ||
| ldap | ||
| md5 | ||
| oauth2 | ||
| pbkdf2 | ||
| plain-text | ||
| saml2 | ||
| sha256salted | ||
