[JIRA] [saml-plugin] (JENKINS-31043) SAML plugin can't auth with CSRF protection enabled

mdonohue@java.net (JIRA)

unread,

Oct 20, 2015, 2:23:01 AM10/20/15

to jenkinsc...@googlegroups.com

mdonohue created an issue

Jenkins /

JENKINS-31043

SAML plugin can't auth with CSRF protection enabled

Issue Type:	Bug
Assignee:	Ben McCann
Components:	saml-plugin
Created:	20/Oct/15 6:22 AM
Priority:	Critical
Reporter:	mdonohue

I have SAML configured to auth users. We recently decided to turn on CSRF protection, but discovered it prevents anyone from authenticating via SAML. The securityRealm/loginFinished page produces a "missing CSRF crumb" error.

Add Comment

This message was sent by Atlassian JIRA (v6.4.2#64017-sha1:e244265)

mdonohue@java.net (JIRA)

unread,

Oct 20, 2015, 11:07:02 PM10/20/15

to jenkinsc...@googlegroups.com

mdonohue commented on

JENKINS-31043

Re: SAML plugin can't auth with CSRF protection enabled

The CSRF protection can be disabled in some circumstances - I wrote a patch against the saml plugin to exclude the loginFinished endpoint from CSRF protection. This gets rid of the missing crumb error, but login does not complete either.

This is the patch: https://github.com/mdonohue/saml-plugin/commit/717fd8cb75b5f8ab65a48fcafded25c1f802f7ac