address copilot comments

ksroda-sa · ksroda-sa · commit 03227dc6bc11 · 2026-04-28T10:09:17.000+02:00
diff --git a/samples/dotnet/saml-sp-login/tests/AuthIntegrationTests.cs b/samples/dotnet/saml-sp-login/tests/AuthIntegrationTests.cs
@@ -9,26 +9,59 @@
 
 namespace SamlSpLogin.Tests;
 
-public class AuthIntegrationTests : IClassFixture<WebApplicationFactory<Program>>
+public class AuthIntegrationTests : IClassFixture<WebApplicationFactory<Program>>, IDisposable
 {
+    private static readonly string[] ManagedEnvVars =
+    {
+        "SAML_SP_ENTITY_ID",
+        "SAML_IDP_ENTITY_ID",
+        "SAML_IDP_SSO_URL",
+        "SAML_IDP_SIGNING_CERT_PATH",
+    };
+
     private readonly WebApplicationFactory<Program> _factory;
+    private readonly string _certPath;
+    private readonly Dictionary<string, string?> _previousEnv;
 
     public AuthIntegrationTests(WebApplicationFactory<Program> factory)
     {
         // Write a self-signed stub PEM cert to a temp file so the SP startup code
         // (which loads SAML_IDP_SIGNING_CERT_PATH at boot) finds a valid X.509.
         // The cert is never validated against a real assertion; tests stub auth
         // entirely via TestAuthHandler.
-        var certPath = WriteStubCertPemFile();
+        _certPath = WriteStubCertPemFile();
+
+        // Snapshot prior env-var values so Dispose can restore them, avoiding
+        // process-wide leakage between test classes or runs.
+        _previousEnv = ManagedEnvVars.ToDictionary(
+            name => name,
+            name => Environment.GetEnvironmentVariable(name));
 
         Environment.SetEnvironmentVariable("SAML_SP_ENTITY_ID", "https://localhost:4262/saml/metadata");
         Environment.SetEnvironmentVariable("SAML_IDP_ENTITY_ID", "https://idp.example/test");
         Environment.SetEnvironmentVariable("SAML_IDP_SSO_URL", "https://idp.example/test/sso");
-        Environment.SetEnvironmentVariable("SAML_IDP_SIGNING_CERT_PATH", certPath);
+        Environment.SetEnvironmentVariable("SAML_IDP_SIGNING_CERT_PATH", _certPath);
 
         _factory = factory;
     }
 
+    public void Dispose()
+    {
+        foreach (var name in ManagedEnvVars)
+        {
+            Environment.SetEnvironmentVariable(name, _previousEnv[name]);
+        }
+        try
+        {
+            if (File.Exists(_certPath)) File.Delete(_certPath);
+        }
+        catch
+        {
+            // Best-effort cleanup; ignore any I/O failures.
+        }
+        GC.SuppressFinalize(this);
+    }
+
     [Fact]
     public async Task Root_Unauthenticated_ShowsSignIn()
     {
diff --git a/samples/java/saml-sp-login/README.md b/samples/java/saml-sp-login/README.md
@@ -51,8 +51,8 @@ The next SAML response will include an `<AttributeStatement>` with those attribu
 - Cross-site cookie config (`SameSite=None; Secure`) so the JSESSIONID survives the POST from CIAM back to the ACS endpoint
 - A targeted bearer-confirmation validator that works around CIAM-specific quirks: a malformed `Address` attribute (host:port form instead of IP-only) and the unreliability of session-stored `InResponseTo` state across cross-site POSTs. The response-level signature (verified against the IdP signing cert) still runs and provides the core security guarantee.
 - An ACS endpoint at `/login/saml2/sso/secureauth` that validates IdP-signed SAML responses and accepts both SP- and IdP-initiated flows
-- Customizing `OpenSaml5AuthenticationProvider`'s response validator to accept unsolicited (IdP-initiated) responses
-- Server-managed session via Spring Session carrying the SAML `Saml2AuthenticatedPrincipal`
+- Customizing `OpenSaml4AuthenticationProvider`'s response validator to accept unsolicited (IdP-initiated) responses
+- Server-managed session via the default servlet `HttpSession` / `JSESSIONID` carrying the SAML `Saml2AuthenticatedPrincipal`
 - Local logout (clears the session — CIAM does not implement SAML SLO)
 
 ## Tests
diff --git a/scripts/aggregate-manifests.ts b/scripts/aggregate-manifests.ts
@@ -83,6 +83,7 @@ async function main() {
           run_command: _rc,
           lib: _lib,
           docs_url: _docs,
+          callout: _callout,
           ...scenarioForAllFrameworks
         } = scenario;
         scenarios[scenarioId] = {
diff --git a/scripts/extract-snippets.ts b/scripts/extract-snippets.ts
@@ -31,12 +31,14 @@ interface FrameworkSnippet {
   install: string;
   repo_path: string;
   run_command?: string;
+  callout?: string;
 }
 
 interface ScenarioMeta {
   run_command?: string;
   lib?: string;
   docs_url?: string;
+  callout?: string;
   [key: string]: unknown;
 }
 
@@ -315,6 +317,7 @@ async function main() {
       const scenarioLib = manifest.scenarios[scenarioId]?.lib ?? manifest.lib;
       const scenarioDocsUrl =
         manifest.scenarios[scenarioId]?.docs_url ?? manifest.docs_url;
+      const scenarioCallout = manifest.scenarios[scenarioId]?.callout;
       snippets[scenarioId][fw] = {
         steps: allSteps,
         framework: fw,
@@ -324,6 +327,7 @@ async function main() {
         install: getInstallCommand(scenarioDir),
         repo_path: `samples/${path.relative(SAMPLES, scenarioDir)}`,
         ...(runCommand ? { run_command: runCommand } : {}),
+        ...(scenarioCallout ? { callout: scenarioCallout } : {}),
       };
     }
   }
diff --git a/snippet-manifest.yaml b/snippet-manifest.yaml
@@ -42,7 +42,6 @@ scenarios:
     display_name: User Login
     grant: Auth Code + PKCE
     description: Redirect users to SecureAuth for login. PKCE protects against code interception.
-    callout: Uses PKCE — no client secret needed. The browser generates a code_verifier/code_challenge pair.
     config_rows:
       - label: Client ID
         value: "{{CLIENT_ID}}"
@@ -65,9 +64,6 @@ scenarios:
     display_name: Token Refresh
     grant: Refresh Token
     description: Use refresh tokens to get new access tokens without re-prompting the user. Requires offline_access scope.
-    callout: >-
-      Requires refresh_token grant type enabled in workspace [OAuth settings](workspace-oauth-general) and in the
-      application's [Grant Types](workspace-applications-oauth). Also requires the offline_access scope.
     required_scopes:
       - offline_access
     config_rows:
@@ -92,9 +88,6 @@ scenarios:
     description: >-
       Redirect users to SecureAuth for login. The server holds the client secret and manages the session; PKCE adds
       defense in depth.
-    callout: >-
-      Server-side flow — the client_secret never reaches the browser. PKCE is still enabled to protect against
-      authorization-code interception during the redirect back to /callback.
     config_rows:
       - label: Client ID
         value: "{{CLIENT_ID}}"
@@ -121,9 +114,6 @@ scenarios:
     description: >-
       Use refresh tokens server-side to renew the user's access token without re-prompting them. Requires the
       offline_access scope.
-    callout: >-
-      Requires refresh_token grant type enabled in workspace [OAuth settings](workspace-oauth-general) and in the
-      application's [Grant Types](workspace-applications-oauth). Also requires the offline_access scope.
     required_scopes:
       - offline_access
     config_rows:
@@ -150,9 +140,6 @@ scenarios:
     display_name: SAML Login
     grant: SAML 2.0
     description: SAML SSO with SecureAuth as the IdP. The same ACS endpoint accepts SP-initiated and IdP-initiated responses.
-    callout: >-
-      AuthnRequests are unsigned for simplicity — CIAM accepts unsigned requests by default. For production, configure
-      SP request signing per your library's docs.
     config_rows:
       - label: SP Entity ID
         value: "{{SAML_SP_ENTITY_ID}}"
diff --git a/snippets.json b/snippets.json
@@ -33,7 +33,8 @@
       "docs_url": "https://github.com/damienbod/angular-auth-oidc-client",
       "install": "angular-auth-oidc-client",
       "repo_path": "samples/angular/login-pkce",
-      "run_command": "yarn install && yarn start"
+      "run_command": "yarn install && yarn start",
+      "callout": "Uses PKCE — no client secret needed. The browser generates a code_verifier/code_challenge pair."
     },
     "react": {
       "steps": [
@@ -76,7 +77,8 @@
       "docs_url": "https://github.com/authts/react-oidc-context",
       "install": "oidc-client-ts react-oidc-context",
       "repo_path": "samples/react/login-pkce",
-      "run_command": "yarn install && yarn start"
+      "run_command": "yarn install && yarn start",
+      "callout": "Uses PKCE — no client secret needed. The browser generates a code_verifier/code_challenge pair."
     },
     "vue": {
       "steps": [
@@ -119,7 +121,8 @@
       "docs_url": "https://github.com/authts/oidc-client-ts",
       "install": "oidc-client-ts",
       "repo_path": "samples/vue/login-pkce",
-      "run_command": "yarn install && yarn start"
+      "run_command": "yarn install && yarn start",
+      "callout": "Uses PKCE — no client secret needed. The browser generates a code_verifier/code_challenge pair."
     }
   },
   "spa_token_refresh": {
@@ -156,7 +159,8 @@
       "docs_url": "https://github.com/damienbod/angular-auth-oidc-client",
       "install": "angular-auth-oidc-client",
       "repo_path": "samples/angular/token-refresh",
-      "run_command": "yarn install && yarn start"
+      "run_command": "yarn install && yarn start",
+      "callout": "Requires refresh_token grant type enabled in workspace [OAuth settings](workspace-oauth-general) and in the application's [Grant Types](workspace-applications-oauth). Also requires the offline_access scope."
     },
     "react": {
       "steps": [
@@ -199,7 +203,8 @@
       "docs_url": "https://github.com/authts/react-oidc-context",
       "install": "oidc-client-ts react-oidc-context",
       "repo_path": "samples/react/token-refresh",
-      "run_command": "yarn install && yarn start"
+      "run_command": "yarn install && yarn start",
+      "callout": "Requires refresh_token grant type enabled in workspace [OAuth settings](workspace-oauth-general) and in the application's [Grant Types](workspace-applications-oauth). Also requires the offline_access scope."
     },
     "vue": {
       "steps": [
@@ -242,7 +247,8 @@
       "docs_url": "https://github.com/authts/oidc-client-ts",
       "install": "oidc-client-ts",
       "repo_path": "samples/vue/token-refresh",
-      "run_command": "yarn install && yarn start"
+      "run_command": "yarn install && yarn start",
+      "callout": "Requires refresh_token grant type enabled in workspace [OAuth settings](workspace-oauth-general) and in the application's [Grant Types](workspace-applications-oauth). Also requires the offline_access scope."
     }
   },
   "server_login_auth_code": {
@@ -279,7 +285,8 @@
       "docs_url": "https://learn.microsoft.com/en-us/aspnet/core/security/authentication/configure-oidc-web-authentication",
       "install": "",
       "repo_path": "samples/dotnet/login-auth-code",
-      "run_command": "dotnet restore && dotnet run --project src"
+      "run_command": "dotnet restore && dotnet run --project src",
+      "callout": "Server-side flow — the client_secret never reaches the browser. PKCE is still enabled to protect against authorization-code interception during the redirect back to /callback."
     },
     "java": {
       "steps": [
@@ -322,7 +329,8 @@
       "docs_url": "https://docs.spring.io/spring-security/reference/servlet/oauth2/login/index.html",
       "install": "",
       "repo_path": "samples/java/login-auth-code",
-      "run_command": "mvn spring-boot:run"
+      "run_command": "mvn spring-boot:run",
+      "callout": "Server-side flow — the client_secret never reaches the browser. PKCE is still enabled to protect against authorization-code interception during the redirect back to /login/oauth2/code/secureauth."
     },
     "node": {
       "steps": [
@@ -365,7 +373,8 @@
       "docs_url": "https://github.com/panva/openid-client",
       "install": "openid-client",
       "repo_path": "samples/node/login-auth-code",
-      "run_command": "yarn install && yarn start"
+      "run_command": "yarn install && yarn start",
+      "callout": "Server-side flow — the client_secret never reaches the browser. PKCE is still enabled to protect against authorization-code interception during the redirect back to /callback."
     }
   },
   "server_token_refresh": {
@@ -418,7 +427,8 @@
       "docs_url": "https://learn.microsoft.com/en-us/aspnet/core/security/authentication/configure-oidc-web-authentication",
       "install": "",
       "repo_path": "samples/dotnet/token-refresh",
-      "run_command": "dotnet restore && dotnet run --project src"
+      "run_command": "dotnet restore && dotnet run --project src",
+      "callout": "Requires refresh_token grant type enabled in workspace [OAuth settings](workspace-oauth-general) and in the application's [Grant Types](workspace-applications-oauth). Also requires the offline_access scope."
     },
     "java": {
       "steps": [
@@ -477,7 +487,8 @@
       "docs_url": "https://docs.spring.io/spring-security/reference/servlet/oauth2/login/index.html",
       "install": "",
       "repo_path": "samples/java/token-refresh",
-      "run_command": "mvn spring-boot:run"
+      "run_command": "mvn spring-boot:run",
+      "callout": "Requires refresh_token grant type enabled in workspace [OAuth settings](workspace-oauth-general) and in the application's [Grant Types](workspace-applications-oauth). Also requires the offline_access scope."
     },
     "node": {
       "steps": [
@@ -528,7 +539,8 @@
       "docs_url": "https://github.com/panva/openid-client",
       "install": "openid-client",
       "repo_path": "samples/node/token-refresh",
-      "run_command": "yarn install && yarn start"
+      "run_command": "yarn install && yarn start",
+      "callout": "Requires refresh_token grant type enabled in workspace [OAuth settings](workspace-oauth-general) and in the application's [Grant Types](workspace-applications-oauth). Also requires the offline_access scope."
     }
   },
   "server_saml_sp_login": {
@@ -565,7 +577,8 @@
       "docs_url": "https://github.com/Sustainsys/Saml2",
       "install": "",
       "repo_path": "samples/dotnet/saml-sp-login",
-      "run_command": "dotnet restore && dotnet run --project src"
+      "run_command": "dotnet restore && dotnet run --project src",
+      "callout": "AuthnRequests are unsigned for simplicity — CIAM accepts unsigned requests by default. For production, configure SP request signing per your library's docs."
     },
     "java": {
       "steps": [
@@ -600,7 +613,8 @@
       "docs_url": "https://docs.spring.io/spring-security/reference/servlet/saml2/login/index.html",
       "install": "",
       "repo_path": "samples/java/saml-sp-login",
-      "run_command": "mvn spring-boot:run"
+      "run_command": "mvn spring-boot:run",
+      "callout": "Spring Security 6.4 always signs AuthnRequests; this sample reuses the dev TLS keystore as the SP signing credential. CIAM doesn't validate the signature (no SP cert registered), so the request is accepted as if unsigned. For production, generate a dedicated SP signing key and register its public cert in CIAM's SAML SP form."
     },
     "node": {
       "steps": [
@@ -635,7 +649,8 @@
       "docs_url": "https://github.com/node-saml/passport-saml",
       "install": "@node-saml/passport-saml passport",
       "repo_path": "samples/node/saml-sp-login",
-      "run_command": "yarn install && yarn start"
+      "run_command": "yarn install && yarn start",
+      "callout": "AuthnRequests are unsigned for simplicity — CIAM accepts unsigned requests by default. For production, configure SP request signing per your library's docs."
     }
   }
 }
