SAML Allow for issuer != MetadataEndpoint about konnect HOT 3 CLOSED

Thanks for the feedback. Konnect loads the metadata from the configured URI. So all information from there could be used.

Seems like an easy change at https://github.com/Kopano-dev/konnect/blob/master/identity/authorities/saml2.go#L124-L126 assuming the issuer URI is found in the meta data (for example by using EntityID).

For example

diff --git a/identity/authorities/saml2.go b/identity/authorities/saml2.go
index 632f003..79fbf2e 100644
--- a/identity/authorities/saml2.go
+++ b/identity/authorities/saml2.go
@@ -122,7 +122,7 @@ func (ar *saml2AuthorityRegistration) Authority() *Details {
 }

 func (ar *saml2AuthorityRegistration) Issuer() string {
-       return ar.metadataEndpoint.String()
+       return ar.serviceProvider.IDPMetadata.EntityID
 }

 func (ar *saml2AuthorityRegistration) Validate() error {
(END)

I am looking at https://github.com/keycloak/keycloak/blob/master/services/src/main/resources/idp-metadata-template.xml - can you please check where to find the Issuer URI if its not the metadata URI and report back?

We could add a configuration field for this if not possible to retrieve the issuer URI from anywhere.

from konnect.

I just confirmed with my test-setup. Looks like keycloak is using it's entity-id so your fix would be sufficient.

If needed, I could test the fix next monday.

from konnect.

Thanks for confirming - the above path will be included in the next release.

from konnect.