Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Backport #11805 to branch/v9 #11936

Merged
merged 3 commits into from
Apr 22, 2022
Merged

Backport #11805 to branch/v9 #11936

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
7123226
Added support for JumpCloud.
russjones Apr 7, 2022
a133be5
Merge branch 'branch/v9' into rjones/backport-11805
r0mant Apr 22, 2022
7e4b28e
Merge branch 'branch/v9' into rjones/backport-11805
r0mant Apr 22, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions constants.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -455,6 +455,8 @@ const (
Ping = "ping"
// Okta should be used for Okta OIDC providers.
Okta = "okta"
// JumpCloud is an identity provider.
JumpCloud = "jumpcloud"
)

const (
Expand Down
12 changes: 7 additions & 5 deletions lib/services/saml.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -211,16 +211,18 @@ func GetSAMLServiceProvider(sc types.SAMLConnector, clock clockwork.Clock) (*sam
NameIdFormat: "urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified",
}

// adfs specific settings
if sc.GetProvider() == teleport.ADFS {
// Provider specific settings for ADFS and JumpCloud. Specifically these
// providers do not support C14N11, which means a C14N10 canonicalizer has to
// be used.
switch sc.GetProvider() {
case teleport.ADFS, teleport.JumpCloud:
log.WithFields(log.Fields{
trace.Component: teleport.ComponentSAML,
}).Debug("Setting ADFS values.")
}).Debug("Setting ADFS/JumpCloud values.")
if sp.SignAuthnRequests {
// adfs does not support C14N11, we have to use the C14N10 canonicalizer
sp.SignAuthnRequestsCanonicalizer = dsig.MakeC14N10ExclusiveCanonicalizerWithPrefixList(dsig.DefaultPrefix)

// at a minimum we require password protected transport
// At a minimum we require password protected transport.
sp.RequestedAuthnContext = &saml2.RequestedAuthnContext{
Comparison: "minimum",
Contexts: []string{"urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport"},
Expand Down