Skip to content

fix shibboleth misconfigurations resulting in authentication bypass

Brian Neelrequested to merge
fix-shibboleth-auth-with-no-uid into master

This merge request fixes #22267 (closed) where a misconfigured Shibboleth HTTP_UID or HTTP_EPPN could result in users being logged into an account that did not belong to them.

Merge request reports