SAML SSO not working in API

[jfagoagas]

[github-actions]

✅ Issue Triage completed successfully!

[github-actions]

AI Assessment [Experimental]: Needs More Information

Severity: unknown

Summary

Cannot produce a coding agent plan with the information provided. The issue states "SAML SSO not working in API" but provides no details about the failure mode, error messages, reproduction steps, or expected vs actual behavior. I found SAML SSO functionality was recently added according to api/CHANGELOG.md (v1.10.0, PR #8175), and the codebase contains extensive SAML implementation including SAMLConfigurationViewSet, SAMLInitiateAPIView, SAMLTokenValidateView, and TenantFinishACSView in api/src/backend/api/v1/views.py.

Questions for the Reporter

1. What specific SAML SSO operation is failing? (e.g., initiation, authentication callback, token validation, configuration CRUD)
2. What error message or status code do you see? Include the full error response body if available.
3. What are the exact steps to reproduce? Include API endpoint, HTTP method, request payload, and authentication headers.
4. What Prowler API version are you using? (Check if v1.10.0+ which includes SAML support)
5. What is the expected behavior vs actual behavior? Describe what should happen and what actually happens.
6. Are there any relevant logs from the API server? Server-side logs may reveal the root cause (check for "SAML dispatch failed" or "SAML user is not authenticated").

What We Found So Far

• SAML SSO Feature: Recently added in Prowler API v1.10.0 (PR #8175), located in api/src/backend/api/v1/views.py
• Implemented Components:
  • SAMLConfigurationViewSet (lines 540-562): CRUD operations for SAML configurations per tenant
  • SAMLInitiateAPIView (lines 470-508): Initiates SAML login flow
  • SAMLTokenValidateView (lines 421-439): Validates and retrieves SAML tokens
  • TenantFinishACSView (lines 565-640+): Handles SAML assertion consumer service callback
  • CustomSAMLLoginView (lines 443-466): Converts GET to POST for SAML login
• Error Handling: The code includes error handling for missing configurations (SAMLDomainIndex.DoesNotExist, SAMLConfiguration.DoesNotExist), expired tokens, and authentication failures
• No Tests Found: Could not locate test files for SAML functionality in the API directory
• No Duplicates: No similar SAML SSO issues found in the repository

Next Steps: Please provide the information requested above so I can analyze the specific failure, identify the root cause, and produce a coding agent plan.

AI generated by Issue Triage