feat: SAML 2.0 SP federation + login-provider single-modal Add+Edit#17

Merged

windischb merged 42 commits into

feat/saml-federation

May 28, 2026

Commits on May 27, 2026

docs(saml): consolidate 6 Q&A decisions + add multi-IdP UX plan-page
windischb
committed
feat(saml): add ITfoxtec.Identity.Saml2 + DI placeholder hook
windischb
committed
ui(modal): add header-actions slot to ModalLayout
windischb
committed
feat(saml): define SamlFlavorData shape + JSON contract
windischb
committed
feat(saml): flavor registry — Generic + EntraID + ADFS
windischb
committed
dev(saml-idp): local SAML test IdP via simplesamlphp container
windischb
committed
feat(saml): DynamicSamlSchemeManager + per-realm endpoint wiring
windischb
committed
feat(saml): per-realm SP signing cert with rotation overlap
windischb
committed
feat(saml): full ACS callback + login + SP metadata via ITfoxtec
windischb
committed
feat(saml): periodic IdP metadata refresh background service
windischb
committed
feat(saml): admin UI exposes SAML flavors + types in picker
windischb
committed
feat(saml): end-to-end smoke against simplesamlphp + docs
windischb
committed
feat(saml): admin Allgemein tab shows SP-metadata + ACS URLs for SAML providers

windischb
and
claude
committed
test(saml): retarget unsupported-type processor test to Ldap

windischb
and
claude
committed
feat(login-providers): CreateLoginProviderCommand accepts full provider state

windischb
and
claude
committed
feat(login-providers): unified Add+Edit modal with flavor picker in header

windischb
and
claude
committed
docs(login-providers): mark Phase 2a (single-modal) shipped, Quick-Map deferred

windischb
and
claude
committed
fix(saml,login-providers): block 1 — signature enforcement, Create readiness gates, Add-flow required-field validation

windischb
and
claude
committed
fix(saml): block 2 — decryption-cert overlap, reject empty-cert metadata, document link-flow gap

windischb
and
claude
committed
fix(saml,login-providers): block 3 — cert disposal, rotation cooldown, stale-cache eviction, Type-aware Update

windischb
and
claude
committed
docs(admin): public docs sync with single-modal Add+Edit flow

windischb
and
claude
committed
docs(dev-docs): plan PR-image build via /build-image comment

windischb
and
claude
committed
docs(codeql-triage): extend cs/log-forging FP list with 4 SAML findings

windischb
and
claude
committed
fix(ci): GitVersion + defensive version-build against empty pre-release-label

windischb
and
claude
committed
docs(dev-docs): extend pr-image plan with tag-strategy section

windischb
and
claude
committed
fix(login-providers): skip ConfigSchema Required gate for SAML Create

windischb
and
claude
committed
fix(saml): FlavorData casing tie-breaker prefers PascalCase admin input

windischb
and
claude
committed
fix(login-providers): import FlavorConfigFieldDto in LoginProviderDetails

windischb
and
claude
committed
fix(login-providers): guard pascal[0] under noUncheckedIndexedAccess

windischb
and
claude
committed
feat(login-providers): admin-chosen immutable slug in provider URLs

windischb
and
claude
committed
fix(login-providers): escape {slug} in slug hint so i18n doesn't eat it

windischb
and
claude
committed
feat(login-providers): Display Name + Slug side by side, live slug derivation

windischb
and
claude
committed
test(login-providers): cover HostAwareOpenIdConnectHandler realm tiebreaker

windischb
and
claude
committed
docs(codeql-triage): add cs/log-forging alert 37 (OIDC scheme registration)

windischb
and
claude
committed
feat(login-providers): show SAML providers as login + profile buttons

windischb
and
claude
committed
fix(signalr): scope realtime push to the originating realm

windischb
and
claude
committed
fix(saml): default WantResponseSigned off + expose signing toggles in admin UI

windischb
and
claude
committed