[HUE-8690] Hue allows unsigned SAML assertions - Cloudera Open Source

Details

Type: Bug
Status: Resolved
Priority: Major
Resolution: Fixed
Affects Version/s: 4.3.0
Fix Version/s: 4.4.0
Component/s: core.api
Labels:
None
Environment:

Hide

It appears that if Hue receives an unsigned assertion then it will continue to process it as valid. This means it is possible for an end-user to forge or remove the signature and manipulate a SAML assertion to gain access without a successful authentication.

Show
It appears that if Hue receives an unsigned assertion then it will continue to process it as valid. This means it is possible for an end-user to forge or remove the signature and manipulate a SAML assertion to gain access without a successful authentication.