You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Currently, when performing SAML tests, the security-dashboards-plugin spins up a node-based SAML IdP based on the saml-idp node package. The last published version of this package was 5 years ago and it gets flagged by scanners as having transitive dependencies with vulnerabilities.
Before running the SAML tests, this repo has a prescript to run this IdP which spins up a separate process hosted at http://localhost:7000. When running tests with SAML the application redirects out of OSD (http://localhost:5601) to the IdP (http://localhost:7000) and is redirected back into OSD after successful authentication.
We should either contribute a fix upstream or replace the node-based IdP all together with something like SimpleSAML.
When testing the OIDC login flow, this repo uses Keycloak, it may be possible to run Keycloak as a SAML provider as well which could be another avenue looked into.
The text was updated successfully, but these errors were encountered:
Is your feature request related to a problem?
Currently, when performing SAML tests, the security-dashboards-plugin spins up a node-based SAML IdP based on the saml-idp node package. The last published version of this package was 5 years ago and it gets flagged by scanners as having transitive dependencies with vulnerabilities.
Before running the SAML tests, this repo has a prescript to run this IdP which spins up a separate process hosted at
http://localhost:7000
. When running tests with SAML the application redirects out of OSD (http://localhost:5601) to the IdP (http://localhost:7000) and is redirected back into OSD after successful authentication.We should either contribute a fix upstream or replace the node-based IdP all together with something like SimpleSAML.
When testing the OIDC login flow, this repo uses Keycloak, it may be possible to run Keycloak as a SAML provider as well which could be another avenue looked into.
The text was updated successfully, but these errors were encountered: