Repository navigation
Conversation
… for the client When a SAML sign-in fails during an authorization request, the failure handler sends the browser back to the redirect_uri of the saved /oauth/authorize request, with error=access_denied and the error description. The saved request holds the query string as it was received, before the redirect_uri was compared with the client's registered values. The handler now loads the client named in the saved request and resolves the redirect_uri with the same RedirectResolver that /oauth/authorize uses. A registered redirect_uri is used as before. When the client is unknown, the request has no client_id, or the redirect_uri does not match the client, nothing is redirected and the user sees the /saml_error page. The error and error_description sent to a registered redirect_uri are unchanged.
cf-foundation-community-automation
Bot
moved this to Inbox
in Foundational Infrastructure Working Group
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
An active moderate issue remains because malformed saved redirect URIs can throw an uncaught exception during failed SAML sign-in, causing a server error instead of the intended fallback.
1 open issue
What changed in this PR
This PR stops a failed SAML sign-in from sending the browser to any redirect_uri in the saved /oauth/authorize request. The handler now loads the client named in that request and checks the redirect_uri with the same RedirectResolver that /oauth/authorize uses. If the client is unknown, the client_id is missing, or the redirect_uri is not registered, the user sees /saml_error. The error and error_description parameters sent to a registered URI are unchanged.
Changes:
SamlLoginAuthenticationFailureHandlertakes the redirect resolver, client services, and zone manager as constructor arguments. It only redirects after theredirect_uriresolves for the client.SamlAuthenticationFilterConfigwires those beans into the failure handler bean.- Unit, zone-path, MockMvc, and integration tests cover registered, unregistered, unknown-client, and missing-
client_idcases.
| File | Description |
|---|---|
| uaa/src/test/java/org/cloudfoundry/identity/uaa/mock/saml/SamlAuthenticationMockMvcTests.java | Adds MockMvc tests for a failed SAML sign-in with a registered and an unregistered redirect_uri. |
| uaa/src/test/java/org/cloudfoundry/identity/uaa/integration/feature/SamlFailureRedirectIT.java | New integration test that checks the browser lands on /saml_error or the registered redirect after a failed sign-in. |
| server/src/test/java/org/cloudfoundry/identity/uaa/provider/saml/SamlLoginAuthenticationFailureHandlerZonePathTest.java | Updates existing tests for the new constructor and adds cases for unregistered and unknown clients across zone path modes. |
| server/src/test/java/org/cloudfoundry/identity/uaa/provider/saml/SamlLoginAuthenticationFailureHandlerTest.java | Updates existing tests for the new constructor and adds cases for unregistered, unknown, and missing client_id requests. |
| server/src/main/java/org/cloudfoundry/identity/uaa/provider/saml/SamlLoginAuthenticationFailureHandler.java | Resolves the saved redirect_uri against the client's registered URIs and falls back to /saml_error when it does not match. |
| server/src/main/java/org/cloudfoundry/identity/uaa/provider/saml/SamlAuthenticationFilterConfig.java | Passes the resolver, client services, and zone manager into the failure handler bean. |
Review effort: Lite
strehle
approved these changes
Nov 12, 2026
github-project-automation
Bot
moved this from Inbox
to Pending Merge | Prioritized
in Foundational Infrastructure Working Group
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
… for the client
When a SAML sign-in fails during an authorization request, the failure handler sends the browser back to the redirect_uri of the saved /oauth/authorize request, with error=access_denied and the error description. The saved request holds the query string as it was received, before the redirect_uri was compared with the client's registered values.
The handler now loads the client named in the saved request and resolves the redirect_uri with the same RedirectResolver that /oauth/authorize uses. A registered redirect_uri is used as before. When the client is unknown, the request has no client_id, or the redirect_uri does not match the client, nothing is redirected and the user sees the /saml_error page.
The error and error_description sent to a registered redirect_uri are unchanged.