Juan Fernandez
194f0cfb8f
Fixes #46641 When Fleet runs under a subpath, server_url already includes that subpath, so appending url_prefix again produced a doubled ACS callback path (e.g. https://host/subpath/subpath/api/v1/fleet/sso/callback), breaking SAML authentication for both login and MDM end user authentication. Drop url_prefix from the callback URL construction so the path is appended directly to server_url, which is the full external base URL. Fixes the same flaw in all five ACS-construction sites: login SSO initiate and callback, and MDM SSO initiate plus both callback branches.
26 lines
1003 B
Go
26 lines
1003 B
Go
package sso
|
|
|
|
import (
|
|
"net/url"
|
|
"strings"
|
|
)
|
|
|
|
// CallbackURL builds a SAML ACS callback URL by appending callbackPath to base
|
|
// (e.g. the parsed server_url). When urlPrefix is configured, it is inserted
|
|
// before callbackPath only if base's path does not already include it, so the
|
|
// configured subpath appears exactly once whether or not the base URL was
|
|
// configured with the prefix. This keeps existing deployments working regardless
|
|
// of which convention they used for server_url.
|
|
//
|
|
// base is not mutated; a new URL is returned.
|
|
func CallbackURL(base *url.URL, urlPrefix, callbackPath string) *url.URL {
|
|
prefix := strings.TrimSuffix(urlPrefix, "/")
|
|
// JoinPath returns a new URL rather than mutating the receiver, so base is left
|
|
// untouched and callers can still use it (e.g. as the expected SAML audience).
|
|
result := base
|
|
if prefix != "" && !strings.HasSuffix(strings.TrimSuffix(base.Path, "/"), prefix) {
|
|
result = result.JoinPath(prefix)
|
|
}
|
|
return result.JoinPath(callbackPath)
|
|
}
|