- Shipped
- 15 Novemba 2026, 12:41 UTC
- Author
- Kamo
- Commit
- 4e85361
oauthserver/saml: SamlIdpCertificates (RSA-2048 self-signed, 10 years, PKCS#8 under PlatformSecretCipher in org_oidc_settings, made with the first SAML app, rotate-saml-cert), SamlIdpXml (OpenSAML 4, lazy init; metadata, AuthnRequest parse Redirect/POST, request signatures, XXE refused, signed Response/Assertion RSA-SHA256 exc-c14n, error Responses), SamlIdpService (SP entity id -> an ACTIVE SAML app of THIS org, registered ACS only, AuthnRequest replay refused via Redis INCR, IdP-initiated only when the app allows; the request rides KoaRequest + ConnectedAppFlow with the marker redirect urn:kamo:saml-idp; NameID EMAIL/PERSISTENT (pairwise when the app is)/UNSPECIFIED/TRANSIENT, attribute mapping; single-use 2-minute post store; SAML_APP_SIGNIN audit), SamlIdpController **************** SamlApps (Connected Apps saml block, spMetadataXml, DUPLICATE_ENTITY_ID). oidc/AppRequestFinisher: a request whose last step is not a code to a redirect (ConnectedAppFlow.issue/fail + consent DENY ask the finisher; consent view carries its marker). GrantWriter recordAppGrant (one ACTIVE grant, widened in place). Kamo's own ID3.3 SP now reads REFEDS MFA as two factors.