Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Use a different SAML IdP for SAML Cypress tests to avoid dependency on outdated node package #2182

Open
cwperks opened this issue Feb 5, 2025 · 0 comments
Labels
enhancement New feature or request triaged

Comments

@cwperks
Copy link
Member

cwperks commented Feb 5, 2025

Is your feature request related to a problem?

Currently, when performing SAML tests, the security-dashboards-plugin spins up a node-based SAML IdP based on the saml-idp node package. The last published version of this package was 5 years ago and it gets flagged by scanners as having transitive dependencies with vulnerabilities.

Before running the SAML tests, this repo has a prescript to run this IdP which spins up a separate process hosted at http://localhost:7000. When running tests with SAML the application redirects out of OSD (http://localhost:5601) to the IdP (http://localhost:7000) and is redirected back into OSD after successful authentication.

We should either contribute a fix upstream or replace the node-based IdP all together with something like SimpleSAML.

When testing the OIDC login flow, this repo uses Keycloak, it may be possible to run Keycloak as a SAML provider as well which could be another avenue looked into.

@cwperks cwperks added enhancement New feature or request untriaged triaged and removed untriaged labels Feb 5, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request triaged
Projects
None yet
Development

No branches or pull requests

1 participant