From 0f2b278dcd4e8e9669c306f351c5d660089e9b5b Mon Sep 17 00:00:00 2001 From: Shivam Mishra Date: Wed, 10 Sep 2025 10:14:01 +0530 Subject: [PATCH] fix: validate SSO token in SAML user authentication check Previously, SAML users could bypass password authentication restrictions by including any sso_auth_token parameter, even invalid ones. Now the method properly validates SSO tokens against Redis storage before allowing the bypass, closing the security vulnerability while maintaining legitimate SSO functionality. --- .../enterprise/devise_overrides/sessions_controller.rb | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/enterprise/app/controllers/enterprise/devise_overrides/sessions_controller.rb b/enterprise/app/controllers/enterprise/devise_overrides/sessions_controller.rb index fae0298cc..17e3ad682 100644 --- a/enterprise/app/controllers/enterprise/devise_overrides/sessions_controller.rb +++ b/enterprise/app/controllers/enterprise/devise_overrides/sessions_controller.rb @@ -36,13 +36,13 @@ module Enterprise::DeviseOverrides::SessionsController private def check_saml_user - # Skip if using SSO token (SAML users can use SSO tokens) - return if params[:sso_auth_token].present? return if params[:email].blank? user = User.from_email(params[:email]) return unless user&.provider == 'saml' + return if params[:sso_auth_token].present? && user.valid_sso_auth_token?(params[:sso_auth_token]) + raise CustomExceptions::Base.new(I18n.t('messages.login_saml_user'), :unauthorized) end end