Skip to content

Link SAML logins to accounts by a persistent identifier - #3308

Merged
ReimarBauer merged 4 commits into
developfrom
fix_saml_linking
Nov 10, 2026
Merged

ReimarBauer merged 4 commits into
developfrom
fix_saml_linking

Conversation

@ReimarBauer

Copy link
Copy Markdown
Member

Purpose of PR?:

Fixes #3307

…e email, accept each SAML response once and harden the test identity provider
…k to the email for taken usernames and let msui log in by SAML to older servers

- an assertion without its own signature counts only with a signed response of the same IdP
- starting a SAML login needs the basic authentication of the server, as the password login
- an unconfirmed account gets a message, the code works again after the confirmation
- several accounts with the email in different case refuse the login instead of picking one
- a malformed code request gets 401 instead of 500, refused responses are logged with their reason
…sui as plain text and keep configured SAML endpoint paths
@ReimarBauer
ReimarBauer requested a review from joernu76 November 7, 2026 12:06
@ReimarBauer ReimarBauer changed the title Unlink SAML identities on a password reset Link SAML logins to accounts by a persistent identifier Nov 7, 2026
@ReimarBauer
ReimarBauer merged commit f51e6b5 into develop Nov 10, 2026
13 checks passed
@ReimarBauer
ReimarBauer deleted the fix_saml_linking branch November 10, 2026 21:53
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

MSColab: SAML login by linked identities, a one-time code for msui, and a working SAML setup again

2 participants