toga-ai 1.0.888 → 1.0.889
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -6,7 +6,7 @@ project: SAML SSO Gateway
|
|
|
6
6
|
client: shared
|
|
7
7
|
type: architecture
|
|
8
8
|
status: active
|
|
9
|
-
updated: 2026-09-
|
|
9
|
+
updated: 2026-09-24
|
|
10
10
|
owners: ["rgirish", "jcardinal"]
|
|
11
11
|
files:
|
|
12
12
|
- saml/index.php
|
|
@@ -79,6 +79,7 @@ Identity mapping lives in `_underscore/Model/<ClientIdentifier>/ClientAuthentica
|
|
|
79
79
|
- **CodePipeline:** Source (GitHub `_production`) → ManualApproval → Deploy (EB).
|
|
80
80
|
- **Composer deps** installed at postdeploy via `015_install_composer.sh`.
|
|
81
81
|
- **Secrets Manager read access.** Shared `ElasticBeanstalk-EC2-Instance-Profile` carries an inline `SecretsManagerReadAll` policy (`secretsmanager:GetSecretValue` + `DescribeSecret`, `Resource: "*"`) so `/acs` can read the SP encryption secrets at runtime. Account-wide `Resource: "*"` was chosen deliberately (shared profile across EB apps); verified effective access with the IAM policy simulator.
|
|
82
|
+
- **Non-prod reads prod secrets cross-account (2026-09-24).** SP secrets live only in prod acct 654654170868, encrypted with customer-managed KMS `alias/toga-secrets`; non-prod EB roles read them cross-account (key policy + secret resource policy + role inline policy `SecretsManagerCrossAccountRead`). Sandbox 975050298201 done; beta 502614707982 not yet. Procedure + add-an-account steps: SP cert-rotation workflow.
|
|
82
83
|
- **Non-prod shared-ALB self-registration (2026-08-27).** Postdeploy hook `060_register_instance_to_shared_application_load_balancer.sh` + `ebs/register_instance_to_shared_application_load_balancer.php` register a non-production `saml` instance into the target group named exactly its EB env name; **skips `production`** (so `saml-production` is unaffected) and always `exit 0`. Requires `aws/aws-sdk-php` (now in `composer.json`, lock/vendor to be regenerated) and two IAM actions on the instance profile (`elasticloadbalancing:DescribeTargetGroups` region-scoped + `RegisterTargets` scoped to the non-prod target-group ARN). See [ALB target-group auto-registration](../worker2/features/alb-target-group-auto-registration.md).
|
|
83
84
|
|
|
84
85
|
## Dependencies
|
|
@@ -95,6 +96,7 @@ Identity mapping lives in `_underscore/Model/<ClientIdentifier>/ClientAuthentica
|
|
|
95
96
|
- **RelayState time check bounds the future, not the past.** `MAX_TIME_TO_LIVE` (300s) sanity-checks how far in the *future* a RelayState timestamp may be. It does not clearly bound replay of an *old* captured RelayState — review before relying on it as replay protection.
|
|
96
97
|
- **`/meta` cert lines must be `trim()`-ed (CRLF).** The `.crt` files in `_underscore/Assets/ssl` are CRLF-encoded; cert-format code does `explode("\n", ...)` and indents each line, so without a per-line `trim()` a stray `\r` ends up on every base64 line inside `<ds:X509Certificate>`. Trim each line in both signing and encryption blocks.
|
|
97
98
|
- **SP encryption certs load from Secrets Manager at request time.** `/acs` holds no encryption key material on disk (`_underscore/Assets/ssl/` no longer carries the SP encryption key). Rotation = edit the `ENCRYPTION_SECRET_NAMES` list + the secrets themselves, not a redeploy of on-disk `.crt`/`.key` files.
|
|
99
|
+
- **Non-prod SAML depends on prod KMS/Secrets Manager; one SP key serves every env** — a non-prod leak is a prod key leak. `ENCRYPTION_SECRET_NAMES` must hold full ARNs (short names resolve only in the caller's account).
|
|
98
100
|
- **Committed AWS key must be rotated.** A hardcoded AWS key was removed from `_underscore/Cloud.php`; because it was committed to git history it is compromised — rotate it. Still open: plaintext creds in `production.ini` and the hardcoded Sentry DSN.
|
|
99
101
|
- **SLS not implemented.** `/sls` falls through to the default banner.
|
|
100
102
|
- **`set_exception_handler(null)` at top of `saml()`.** Unhandled exceptions output raw PHP errors. All exceptions from `getAuthenticatedSsoUser()` are caught and sent to Sentry.
|
package/package.json
CHANGED