saml: capture + diff legacy assertion for NameID continuity
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 35/100
- Issue type
- Feature
- Clarity
- Clearly specified
- Activity status
- Quiet
- Tech stack
- typescript
- Domain
- api, authentication
Research direction
Read plans/saml-idp.md under “Risks & Unknowns,” then capture the SAMLResponse from a real /Slack/Login flow using browser DevTools. Decode it and compare it field-by-field with the decoded response from /api/saml/slack/launch for the same Person. Done means only timestamps and IDs differ; NameID fields, qualifiers, and attribute names remain identical, or any migration issue is identified for fixing.
Written by the indexing model from the issue text.
Description
Capture a real assertion emitted by the legacy laddr emergence-slack code in production, and diff against the assertion the new IdP would emit for the same user.
Surfaced by the saml-idp plan's closeout (PR #49). Per plans/saml-idp.md#risks--unknowns, this is "the single highest-stakes thing in this plan" — the v1 IdP claims to preserve NameID stability for every existing Slack account through cutover. The way to actually prove that is:
- Browser-side: capture a laddr-emitted SAMLResponse during a real /Slack/Login flow (browser devtools → Network tab → look at the POST to slack.com/sso/saml — the SAMLResponse is in the form body, base64-encoded)
- Decode the XML
- For the same Person, build the v1 IdP's response (via /api/saml/slack/launch) and decode
- Diff field-by-field. Acceptable diffs: timestamps, IDs. Unacceptable: NameID.Value, NameID.Format, NameQualifier, SPNameQualifier, attribute names.
If the diff turns up a NameID delta for any user, we need to fix migration before cutover.
Out of band of the v1 PR; needs:
- Access to a logged-in legacy laddr account
- Coordination with that user
- Dominant language
- TypeScript
- Stars
- 1
- Forks
- 1
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 25
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from CodeForPhilly/codeforphilly-ng
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
-
MarkdownEditor toolbar: use Radix Toolbar from radix-ui instead of the hand-rolled roving tabindex Openenhancement
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
All issues in CodeForPhilly/codeforphilly-ng
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
vercel-labs/just-bash#464 ·
-
looksLikeSlug() is ASCII-only, so non-Latin entity slugs (e.g. Korean) skip exact match and collapse Open
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
-
Difficulty 1/5 Under an hour Newbie friendliness 90/100
TanStack/tanstack.com#1293 ·