feat: SAML 2.0 IdP service (SP-initiated Web SSO)#70
Merged
Conversation
Add saml_service_provider table extending application with SAML-specific registration (entity_id, ACS URL, cert, metadata), CRUD endpoints under /applications/:id/saml, and an internal /core/saml/sp/entity/:entityID lookup that resolves an SP to its owning application's client_id for the saml service's access gate.
New saml service modeled on oauth: owns its own RSA signing key + self-signed X.509 cert (saml_signing_key), serves IdP metadata at /saml/metadata, and handles SP-initiated SSO via crewjam/saml. The SSO endpoint validates the AuthnRequest, stashes it, and redirects the browser to the SPA consent page (the first-party session is a SPA-held JWT, not a server cookie). On approval, /saml/authorize re-runs the access gate, builds the assertion from core identity + per-client filtered groups, and returns the HTTP-POST binding payload for the SPA to submit to the ACS. All identity/group/gate/audit data comes from core via the shared kerbecs/sentinel clients.
- kerbecs: add saml upstream + routes (/api/saml/* stripped; /saml/metadata and /saml/sso served at the issuer root; /saml/authorize falls through to the web SPA) - docker-compose: add saml service (port 9996) + gopath volume - add saml Dockerfile + .air.toml (copied from oauth) - CI: add saml build/push workflow; include saml in the deploy image bump
- SamlAuthorizePage at /saml/authorize: the SSO endpoint redirects here, the SPA validates + runs the access gate against the session, and on approval auto-submits the signed assertion to the SP's ACS via HTTP-POST binding - application edit page: add a SAML SSO card to register an app as a service provider (SP entity ID, ACS URL, or pasted metadata XML) and surface the IdP metadata URL
crewjam's Validate re-checks the AuthnRequest IssueInstant against the 90s MaxIssueDelay using req.Now, and stamps the assertion validity window from the same field. Anchor Now to the original SSO-endpoint validation time for the staleness check (so a slow consent screen can't trip the 90s window), then reset to the real current time so the issued assertion carries a fresh window.
- release.sh: bump saml/config Version and tag the sentinel-saml image alongside the other services - deploy.yml: include saml in the infra image-bump set and changelog - saml.yml: per-service build/push workflow (mirrors oauth.yml)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds SAML 2.0 single sign-on to Sentinel via a new
samlservice, modeled on the existingoauthservice. SP-initiated Web SSO only (no IdP-initiated, no SLO).core
saml_service_providertable extending an application with SAML SP registration (entity ID, ACS URL, cert, metadata XML)/applications/:id/saml; internal/core/saml/sp/entity/:entityIDlookup that resolves an SP to its owning application'sclient_idsaml service (new)
saml_signing_key), persisted across restarts; cert published in IdP metadata/saml/metadata(IdP metadata) and/saml/sso(SP-initiated SSO) viacrewjam/saml/saml/authorizeGET (consent info + access gate) and POST (build + sign assertion, return HTTP-POST binding payload for the SPA to submit to the ACS)MaxIssueDelay, while keeping the issued assertion's validity window freshgateway / infra
samlupstream + routes (/api/saml/*stripped;/saml/metadataand/saml/ssoat the issuer root;/saml/authorizefalls through to the web SPA)samlservice (port 9996) + gopath volumesamlbuild/push workflow; includesamlin the deploy image bumpweb
SamlAuthorizePageat/saml/authorize: validates + runs the access gate against the session, then auto-submits the signed assertion to the SP's ACSverification
go build+go vetpass forcoreandsamltsc -b+vite buildpassdocker compose configvalidates