Add configuration option for origin loop (#923)

* Add configuration option for origin loop Depends on PR cloudfoundry/uaa#2932 * Update jobs/uaa/spec Co-authored-by: Adrian Hölzl <102049638+adrianhoelzl-sap@users.noreply.github.com> * Update description Use a more generic description. This flag should be used later also in /identity-providers GET to filter this and not return all IdPs --------- Co-authored-by: Adrian Hölzl <102049638+adrianhoelzl-sap@users.noreply.github.com>
cloudfoundry · Jul 25, 2024 · 2e797c7 · 2e797c7
1 parent d4d0143
commit 2e797c7
Show file tree

Hide file tree

Showing 7 changed files with 10 additions and 1 deletion.
diff --git a/jobs/uaa/spec b/jobs/uaa/spec
@@ -451,6 +451,9 @@ properties:
   login.checkOriginEnabled:
     description: "This flag enables the origin check in SCIM. Otherwise, the assignments of users to an origin are not validated."
     default: false
+  login.allowOriginLoop:
+    description: "This flag allows to retrieve all origins during login or configuration, e.g. all SAML or OIDC identity providers. Otherwise, only filtered access is possible."
+    default: true
 
   # Email
   login.notifications.url:
@@ -1408,4 +1411,4 @@ properties:
            YkYKBatFEKdBFlAKLBdG+5KzE7sTYesn7EzBISHXFz3DhdK2tg+IF1DeSFVmFl2n
            iVxQ1sYjo4kCugHBsWo+MpFH9VBLFzsMlP3eIDuVKe8aPXFKYCGhctZEJdQTKlja
            lshe50nayKrT
-           -----END CERTIFICATE----
+           -----END CERTIFICATE----
diff --git a/jobs/uaa/templates/config/uaa.yml.erb b/jobs/uaa/templates/config/uaa.yml.erb
@@ -672,6 +672,7 @@
       'accountChooserEnabled' => p('login.accountChooserEnabled'),
       'aliasEntitiesEnabled' => p('login.aliasEntitiesEnabled'),
       'checkOriginEnabled' => p('login.checkOriginEnabled'),
+      'allowOriginLoop' => p('login.allowOriginLoop'),
       'entityBaseURL' => login_entityBaseUrl,
       'entityID' => login_entityId,
       'prompt' => {

diff --git a/spec/compare/all-properties-set-uaa.yml b/spec/compare/all-properties-set-uaa.yml
@@ -348,6 +348,7 @@ login:
   accountChooserEnabled: true
   aliasEntitiesEnabled: true
   checkOriginEnabled: true
+  allowOriginLoop: false
   entityBaseURL: http://all-properties-set:8888/uaa
   entityID: all-properties-set:8888/uaa
   prompt:

diff --git a/spec/compare/bosh-lite-uaa.yml b/spec/compare/bosh-lite-uaa.yml
@@ -266,6 +266,7 @@ login:
   accountChooserEnabled: false
   aliasEntitiesEnabled: false
   checkOriginEnabled: false
+  allowOriginLoop: true
   entityBaseURL: https://login.bosh-lite.com
   entityID: login.bosh-lite.com
   prompt:

diff --git a/spec/compare/deprecated-properties-still-work-uaa.yml b/spec/compare/deprecated-properties-still-work-uaa.yml
@@ -220,6 +220,7 @@ login:
   accountChooserEnabled: false
   aliasEntitiesEnabled: false
   checkOriginEnabled: false
+  allowOriginLoop: true
   entityBaseURL: http://test.uaa.url
   entityID: test.uaa.url
   prompt:

diff --git a/spec/compare/test-defaults-uaa.yml b/spec/compare/test-defaults-uaa.yml
@@ -171,6 +171,7 @@ login:
   accountChooserEnabled: false
   aliasEntitiesEnabled: false
   checkOriginEnabled: false
+  allowOriginLoop: true
   entityBaseURL: http://test.uaa.url
   entityID: test.uaa.url
   prompt:

diff --git a/spec/input/all-properties-set.yml b/spec/input/all-properties-set.yml
@@ -40,6 +40,7 @@ properties:
     accountChooserEnabled: true
     aliasEntitiesEnabled: true
     checkOriginEnabled: true
+    allowOriginLoop: false
     links:
       global:
         passwd: "https://{zone.subdomain}.myaccountmanager.domain.com/z/{zone.id}/forgot_password"