Summary:

The changes in this pull request are related to the configuration of SAML identity providers (IDPs) in the Janssen system. The first set of changes updates the documentation for creating and managing SAML IDPs using the Janssen Text-based UI (TUI) or command-line interface. The second set of changes modifies the EditIdentityProvideDialog class, which is responsible for the IDP editing functionality in the command-line application.

The documentation changes provide clear instructions on how to create a new SAML IDP, including navigating to the appropriate section, adding the necessary details, and persisting the IDP configuration in the Janssen database. This centralized management approach is a positive security feature, as it avoids the need for manual configuration in the Keycloak admin console.

The code changes to the EditIdentityProvideDialog class introduce new functionality, such as the ability to select the metadata source type (file or manual), upload a metadata file, and manually configure the IDP metadata. While these changes improve the user experience, they also introduce potential security risks that need to be addressed.

Specifically, the application should implement robust validation and sanitization of the uploaded metadata file and the manually entered metadata fields to prevent the introduction of malicious content or configurations. Additionally, the application should continue to properly handle and validate the realm configuration, as it can have security implications.

Files Changed:

1. docs/admin/keycloak/keycloak-saml-inbound.md:

   • The changes update the documentation for creating and managing SAML IDPs in the Janssen system using the Janssen TUI or command-line interface.
   • The new steps include navigating to the "Jans SAML" > "Identity Providers" section, adding a new identity provider, and providing the necessary details.
   • The IDP details are persisted in the Janssen database, and the ability to edit the IDP details later is also documented.

2. jans-cli-tui/cli_tui/plugins/100_saml/edit_identity_provider_dialog.py:

   • The changes remove the "Realm" field from the EditIdentityProvideDialog class.
   • The dialog now includes a dropdown to select the metadata source type (file or manual).
   • If the "file" option is selected, the dialog displays a button to browse and upload a metadata file.
   • If the "manual" option is selected, the dialog displays various fields for configuring the IDP metadata.
   • The save method handles the save operation, including validation of the metadata file or manual metadata configuration.