Refuse more than one OneTimeUse or ProxyRestriction in a Conditions
@shreemaan-abhishek is already working on this.
Since Aug 27, 2026.
Assessment
This issue has not been assessed yet.
Description
What
Core 2.5.1 says there MUST be at most one <OneTimeUse> and at most one <ProxyRestriction> in a <Conditions>. The bundled XSD cannot enforce it (ConditionsType is choice maxOccurs="unbounded"), and the reader does not either: since #53 <saml:OneTimeUse/><saml:OneTimeUse/> is accepted like one, and duplicate ProxyRestriction has been accepted since #42.
Before #53 the duplicates could not get through, as a side effect of any OneTimeUse being refused.
What to do
The MUST NOT binds the issuer, so the spec does not order a refusal, but a duplicate is a malformed assertion from any conformant IdP and refusing is fail-closed; Keycloak's broker checks exactly this. count_assertion_el(conditions, "OneTimeUse"), already used by the other readers, gives presence and count in one call. Route a count above one down the refusal path with a message naming the duplicate, for both elements, with a test each.
Raised by @jarvis9443 reviewing #53.
- Dominant language
- Perl
- Stars
- 2
- Forks
- 3
- Avg merge
- 2d 20h
- Merged PRs (30d)
- 3
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from api7/lua-resty-saml
-
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
api7/lua-resty-saml#63 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
api7/lua-resty-saml#62 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
api7/lua-resty-saml#45 · 1 comment · 1 reaction ·
-
Difficulty 3/5 1-2 days Newbie friendliness 68/100
api7/lua-resty-saml#64 ·
-
api7/lua-resty-saml#61 · 1 assignee ·
All issues in api7/lua-resty-saml
Similar issues
-
1.severity: security
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
-
Difficulty 1/5 Under an hour Newbie friendliness 68/100
-
Difficulty 1/5 Under an hour Newbie friendliness 82/100
-
Difficulty 1/5 Under an hour Newbie friendliness 72/100
-
Difficulty 1/5 Under an hour Newbie friendliness 60/100
conda-forge/perl-test-warn-feedstock#1 · 1 comment · 1 reaction ·