mirrors/hedgedoc
1
0
Fork 0
mirror of https://github.com/hedgedoc/hedgedoc.git synced 2025-05-30 14:55:27 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

fix(saml): change SAML attribute default, verify that a NameID is defined

Browse source 
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
Signed-off-by: Philip Molares <philip.molares@udo.edu>
This commit is contained in:
Erik Michelson 2025-02-14 02:39:58 +01:00
parent 1a5030dbc1
commit fb6218ed82
4 changed files with 33 additions and 22 deletions
Download patch file Download diff file Expand all files Collapse all files

10
public/docs/release-notes.md
View file

@ -2,6 +2,16 @@
## <i class="fa fa-tag"></i> 1.x.x <i class="fa fa-calendar-o"></i> UNRELEASED
**PLEASE CHECK THIS IF YOU USE SAML AUTHENTICATION:**
This release had to set default values for the username and email address attribute mapping for SAML authentication for
security reasons.
If you use SAML authentication, please make sure to update your SAML configuration accordingly.
See: https://docs.hedgedoc.org/configuration/#saml-login `CMD_SAML_ATTRIBUTE_USERNAME` or `CMD_SAML_ATTRIBUTE_EMAIL`
### Bugfixes
- Abort SAML login if NameID is undefined instead of logging in with a user named "undefined"
- Set default values for username and email attribute mapping in SAML configuration
## <i class="fa fa-tag"></i> 1.10.1 <i class="fa fa-calendar-o"></i> 2024-02-02
This release fixes a security issue where brute-forcing local email/passwords is possible because of missing rate-limits.