auth/saml default remoteuser
| Affects | Status | Importance | Assigned to | Milestone | |
|---|---|---|---|---|---|
| | Mahara |
High
|
PiersHarding | ||
| | 1.4 |
High
|
PiersHarding | ||
Bug Description
The auth/saml plugin should have the option "Match username attribute to Remote username" defaulted to true, as this presents a risk in multi-tenanted Mahara instances (different institutions may clash on usernames so the default behaviour should be to match on the external one).
| Changed in mahara: | |
| status: | New → In Progress |
| assignee: | nobody → PiersHarding (piersharding) |
| Changed in mahara: | |
| status: | In Progress → Fix Committed |
| François Marier (fmarier) wrote : | #1 |
| Changed in mahara: | |
| status: | Fix Committed → In Progress |
| importance: | Undecided → Critical |
| milestone: | none → 1.3.8 |
| security vulnerability: | no → yes |
| Changed in mahara: | |
| importance: | Critical → High |
| tags: | added: saml |
Reviewed: https:/
Committed: http://
Submitter: Francois Marier (<email address hidden>)
Branch: master
commit f07be6020e70fa8
Author: Piers Harding <email address hidden>
Date: Thu Feb 16 06:19:41 2012 +1300
auth/saml default remoteuser (bug #932909)
Ensure that default behaviour is to match user
to remote user name
Change-Id: Iadabb5c4700478
Signed-off-by: Piers Harding <email address hidden>
| François Marier (fmarier) wrote : | #3 |
Piers: would you be able to quickly test the 1.3 and 1.4 cherry-picks I just pushed to gerrit?
https:/
https:/
(I've tested that the setting is turned on by default, but I don't feel confident enough to test the other changes in that patch.)
Richard: given I was the one to do the cherry-pick can you quickly double-check to make sure everything looks fine and give your +2?
| Mahara Bot (dev-mahara) wrote : | #5 |
Reviewed: https:/
Committed: http://
Submitter: Francois Marier (<email address hidden>)
Branch: 1.3_STABLE
commit 46dfa1bcc5bafda
Author: Francois Marier <email address hidden>
Date: Mon Feb 20 14:40:05 2012 +1300
auth/saml default remoteuser (bug #932909)
Ensure that default behaviour is to match user
to remote user name
(cherry picked from commit f07be6020e70fa8
Conflicts:
htdocs/
htdocs/
Change-Id: Ieda14dc11692f3
Signed-off-by: Francois Marier <email address hidden>
| Mahara Bot (dev-mahara) wrote : | #4 |
Reviewed: https:/
Committed: http://
Submitter: Francois Marier (<email address hidden>)
Branch: 1.4_STABLE
commit d642724b4e6016d
Author: Francois Marier <email address hidden>
Date: Mon Feb 20 14:50:32 2012 +1300
auth/saml default remoteuser (bug #932909)
Ensure that default behaviour is to match user
to remote user name
(cherry picked from commit f07be6020e70fa8
Conflicts:
htdocs/
Change-Id: I4db156b2e00233
Signed-off-by: Francois Marier <email address hidden>
| Changed in mahara: | |
| status: | In Progress → Fix Committed |
| Changed in mahara: | |
| status: | Fix Committed → Fix Released |


BTW Piers, we use "fix committed" only when the fix has been merged onto the final branch. While it's in review, we use "in progress".