Skip to content
New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

Use a different SAML IdP for SAML Cypress tests to avoid dependency on outdated node package #2182

Open
cwperks opened this issue Feb 5, 2025 · 0 comments
Labels
enhancement New feature or request triaged

Comments

@cwperks
Copy link
Member

cwperks commented Feb 5, 2025

Is your feature request related to a problem?

Currently, when performing SAML tests, the security-dashboards-plugin spins up a node-based SAML IdP based on the saml-idp node package. The last published version of this package was 5 years ago and it gets flagged by scanners as having transitive dependencies with vulnerabilities.

Before running the SAML tests, this repo has a prescript to run this IdP which spins up a separate process hosted at http://localhost:7000. When running tests with SAML the application redirects out of OSD (http://localhost:5601) to the IdP (http://localhost:7000) and is redirected back into OSD after successful authentication.

We should either contribute a fix upstream or replace the node-based IdP all together with something like SimpleSAML.

When testing the OIDC login flow, this repo uses Keycloak, it may be possible to run Keycloak as a SAML provider as well which could be another avenue looked into.

@cwperks cwperks added enhancement New feature or request untriaged triaged and removed untriaged labels Feb 5, 2025
# for free to join this conversation on GitHub. Already have an account? # to comment
Labels
enhancement New feature or request triaged
Projects
None yet
Development

No branches or pull requests

1 participant