Fix for Issue #3650

[strehle]

Problem: When a SAML IDP's metadata endpoint is unreachable, the ConfiguratorRelyingPartyRegistrationRepository catches the exception, returns null, and the DelegatingRelyingPartyRegistrationRepository falls through to the DefaultRelyingPartyRegistrationRepository which returns a stub registration
pointing to https://www.cloudfoundry.org. The user gets redirected there with all SAML request parameters — confusing UX and a data leak.

[Copilot]

Pull request overview

Prevents a security/UX failure mode in the SAML login flow where failures to fetch IdP metadata could previously fall through to the default stub relying party registration (sending users to https://www.cloudfoundry.org with SAML request parameters).

Changes:

• Fail fast in ConfiguratorRelyingPartyRegistrationRepository by throwing a Saml2Exception on registration build errors (instead of returning null and allowing fallback).
• Improve /error500 handling to surface SAML failures as external_auth_error for both direct Saml2Exception and “cause is Saml2Exception” cases.
• Update/add tests to assert the new exception behavior and error page rendering.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

File	Description
server/src/main/java/org/cloudfoundry/identity/uaa/provider/saml/ConfiguratorRelyingPartyRegistrationRepository.java	Throws Saml2Exception on metadata/build failures to prevent fallback to the default stub registration.
server/src/main/java/org/cloudfoundry/identity/uaa/home/HomeController.java	Extracts Saml2Exception (direct or cause) to return external_auth_error with 400 status.
server/src/test/java/org/cloudfoundry/identity/uaa/provider/saml/ConfiguratorRelyingPartyRegistrationRepositoryTest.java	Updates tests to expect Saml2Exception for invalid metadata inputs.
server/src/test/java/org/cloudfoundry/identity/uaa/login/HomeControllerViewTests.java	Adds coverage for a direct Saml2Exception passed to /error500.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.