fix(auth): allow assigning SSO default role to current user's role or below

[cathteng]

Fixes VULN-79 and RTC-1127

[linear]

VULN-79 Privilege Escalation: Manager Role Can Gain Owner Privileges via SSO Default Role Misconfiguration

RTC-1127 Privilege Escalation: Manager Role Can Gain Owner Privileges via SSO Default Role Misconfiguration

[codecov]

Codecov Report

❌ Patch coverage is 77.77778% with 2 lines in your changes missing coverage. Please review.
✅ All tests successful. No failed tests found.

Files with missing lines	Patch %	Lines
.../sentry/web/frontend/organization_auth_settings.py	77.77%	2 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##           master   #99595      +/-   ##
==========================================
+ Coverage   79.70%   81.24%   +1.54%     
==========================================
  Files        8589     8592       +3     
  Lines      380508   380645     +137     
  Branches    24122    24122              
==========================================
+ Hits       303270   309257    +5987     
+ Misses      76876    71026    -5850     
  Partials      362      362              

[michelletran-sentry]

Are you checking the dropdown to make sure that owner is not in the dropdown? It looks like the update to the post on line 506 just doesn't update?

[cursor]

Bug: SSO Form Role Inconsistency

On the SSO settings form, a non-superuser's default_role field uses organization.default_role as its initial value. If this role is not manageable by the current user, it won't be in the filtered role_choices, leading to an inconsistent form state where the initial selection is unavailable.

src/sentry/web/frontend/organization_auth_settings.py#L81-L92

sentry/src/sentry/web/frontend/organization_auth_settings.py

Lines 81 to 92 in b68ae98

	)
	if provider.is_saml and provider.name != "SAML2":
	# Generic SAML2 provider already includes the certificate field in it's own configure view
	x509cert = forms.CharField(
	label="x509 public certificate",
	widget=forms.Textarea,
	help_text=_("The SAML certificate for your Identity Provider"),
	required=False,
	disabled=disabled,
	)

 

---