OP-22767: Bugfix for SAML2 Authentication validation removed Assertio…

…n disable flags
OpsMx · Oct 24, 2024 · af4c28c · af4c28c
1 parent 13f69db
commit af4c28c
Showing 1 changed file with 3 additions and 7 deletions.
diff --git a/...-saml/src/main/java/com/opsmx/spinnaker/gate/security/saml/SamlSecurityConfiguration.java b/...-saml/src/main/java/com/opsmx/spinnaker/gate/security/saml/SamlSecurityConfiguration.java
@@ -100,9 +100,6 @@ public class SamlSecurityConfiguration {
   @Value("${spring.security.saml2.validation.inresponseto:false}")
   private boolean ignoreInResponseToValidation;
 
-  @Value("${spring.security.saml2.validation.assertion:false}")
-  private boolean ignoreAssertionValidation;
-
   @Bean
   public UserDetailsService userDetailsService() {
     return username -> {
@@ -123,16 +120,15 @@ public RememberMeServices rememberMeServices(UserDetailsService userDetailsServi
 
   @Bean
   public OpenSaml4AuthenticationProvider authenticationProvider() {
+
     var authProvider = new OpenSaml4AuthenticationProvider();
     authProvider.setResponseAuthenticationConverter(extractUserDetails());
-    log.debug("ignoreAssertionValidation :{}", ignoreAssertionValidation);
-    if (ignoreAssertionValidation) {
-      authProvider.setAssertionValidator(removeAssertionError());
-    }
     log.debug("ignoreInResponseToValidation :{}", ignoreInResponseToValidation);
     if (ignoreInResponseToValidation) {
+      authProvider.setAssertionValidator(removeAssertionError());
       authProvider.setResponseValidator(removeInResonseToError());
     }
+
     return authProvider;
   }