From b17b24f37477a12f72401e071b8d7bd8f3d4978b Mon Sep 17 00:00:00 2001 From: Zac Bergquist Date: Wed, 19 Feb 2025 14:31:58 -0700 Subject: [PATCH] Don't emit audit events for illegitimate SAML/OIDC requests Just like #51614 did for GitHub SSO, we suppress login failed events for attempts where the specified connector does not exist. --- lib/auth/auth_with_roles.go | 19 +++++++++++++++++-- 1 file changed, 17 insertions(+), 2 deletions(-) diff --git a/lib/auth/auth_with_roles.go b/lib/auth/auth_with_roles.go index c28a2f2a56471..173172aa361a0 100644 --- a/lib/auth/auth_with_roles.go +++ b/lib/auth/auth_with_roles.go @@ -3495,7 +3495,15 @@ func (a *ServerWithRoles) CreateOIDCAuthRequest(ctx context.Context, req types.O oidcReq, err := a.authServer.CreateOIDCAuthRequest(ctx, req) if err != nil { - emitSSOLoginFailureEvent(a.CloseContext(), a.authServer.emitter, events.LoginMethodOIDC, err, req.SSOTestFlow) + if trace.IsNotFound(err) { + // This flow is triggered via an unauthenticated endpoint, so it's not unusual to see + // attempts to hit this API with an invalid connector ID. These are not legitimate SSO + // attempts, so avoid cluttering the audit log with them. + log.WithField("connector", req.ConnectorID).Infoln("rejecting invalid OIDC auth request") + + } else { + emitSSOLoginFailureEvent(a.CloseContext(), a.authServer.emitter, events.LoginMethodOIDC, err, req.SSOTestFlow) + } return nil, trace.Wrap(err) } @@ -3649,7 +3657,14 @@ func (a *ServerWithRoles) CreateSAMLAuthRequest(ctx context.Context, req types.S samlReq, err := a.authServer.CreateSAMLAuthRequest(ctx, req) if err != nil { - emitSSOLoginFailureEvent(a.CloseContext(), a.authServer.emitter, events.LoginMethodSAML, err, req.SSOTestFlow) + if trace.IsNotFound(err) { + // This flow is triggered via an unauthenticated endpoint, so it's not unusual to see + // attempts to hit this API with an invalid connector ID. These are not legitimate SSO + // attempts, so avoid cluttering the audit log with them. + log.WithField("connector", req.ConnectorID).Infoln("rejecting invalid SAML auth request") + } else { + emitSSOLoginFailureEvent(a.CloseContext(), a.authServer.emitter, events.LoginMethodSAML, err, req.SSOTestFlow) + } return nil, trace.Wrap(err) }