From b8694959b9e04a7da8e4b2dcf2f3a00ce6efcf0b Mon Sep 17 00:00:00 2001 From: Walker Zhao Date: Wed, 29 Jul 2026 10:44:45 +0800 Subject: [PATCH 1/2] fix(saml): clarify signature validation behavior (CVE-2026-14917) Reword the Microsoft Entra how-to danger callout and add a note on the SAML overview page. The plugin now validates the SAML response signature whenever an idp_certificate is set, even when validate_assertion_signature is false. Skipping validation happens only with the flag false and no certificate, which accepts unsigned responses and logs a warning. KAG-9220 Signed-off-by: Walker Zhao --- .../enable-saml-authentication-with-microsoft-entra.md | 7 ++++--- app/_kong_plugins/saml/index.md | 4 ++++ 2 files changed, 8 insertions(+), 3 deletions(-) diff --git a/app/_how-tos/gateway/enable-saml-authentication-with-microsoft-entra.md b/app/_how-tos/gateway/enable-saml-authentication-with-microsoft-entra.md index b49049d9576..515fcf908b3 100644 --- a/app/_how-tos/gateway/enable-saml-authentication-with-microsoft-entra.md +++ b/app/_how-tos/gateway/enable-saml-authentication-with-microsoft-entra.md @@ -107,9 +107,10 @@ Enable the [SAML plugin](/plugins/saml/) and provide the information to connect We also need to provide a value for [`config.session_secret`](/plugins/saml/reference/#schema--config-session-secret), which should be a random 32-character string. {:.danger} -> This example keeps [`validate_assertion_signature`](/plugins/saml/reference/#schema--config-validate-assertion-signature) set to its default value of `true`, which requires a valid `idp_certificate`. -> If you only want to test the authentication flow without configuring a signing certificate, you can manually set `validate_assertion_signature` to `false`. -> Disabling signature validation is **not secure**. **Do not disable signature validation in production.** +> This example keeps [`validate_assertion_signature`](/plugins/saml/reference/#schema--config-validate-assertion-signature) at its default value of `true`, which requires a valid `idp_certificate`. +> The plugin validates the SAML response signature whenever you configure an `idp_certificate`, even if you set `validate_assertion_signature` to `false`. +> The plugin skips signature validation only when `validate_assertion_signature` is `false` and no `idp_certificate` is set. It then accepts unsigned responses and logs a warning. +> This state is **not secure** — an attacker can impersonate any user. Always set `idp_certificate`. Never disable signature validation in production. {% entity_examples %} entities: diff --git a/app/_kong_plugins/saml/index.md b/app/_kong_plugins/saml/index.md index cf6c8e813c0..188aa92f4a4 100644 --- a/app/_kong_plugins/saml/index.md +++ b/app/_kong_plugins/saml/index.md @@ -75,6 +75,10 @@ The minimum configuration required is: information from the IdP. - The issuer (`issuer`): This is the unique identifier of the IdP application. +{:.warning} +> The plugin validates the SAML response signature whenever you set `idp_certificate`, even when [`validate_assertion_signature`](/plugins/saml/reference/#schema--config-validate-assertion-signature) is `false`. +> If you set `validate_assertion_signature` to `false` and configure no `idp_certificate`, the plugin skips signature validation and accepts unsigned responses, which is insecure. Always set `idp_certificate`. + The plugin currently supports SAML 2.0 with Microsoft Entra. Refer to the [Microsoft Entra SAML documentation](https://learn.microsoft.com/en-us/entra/architecture/auth-saml) for more information about SAML authentication with Azure AD. From 952be96fdfcefff252e576a125f0d320d19147c2 Mon Sep 17 00:00:00 2001 From: lena-larionova <54370747+lena-larionova@users.noreply.github.com> Date: Fri, 31 Jul 2026 09:10:03 -0700 Subject: [PATCH 2/2] Apply suggestions from code review Co-authored-by: lena-larionova <54370747+lena-larionova@users.noreply.github.com> --- .../enable-saml-authentication-with-microsoft-entra.md | 5 +++-- app/_kong_plugins/saml/index.md | 2 +- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/app/_how-tos/gateway/enable-saml-authentication-with-microsoft-entra.md b/app/_how-tos/gateway/enable-saml-authentication-with-microsoft-entra.md index 515fcf908b3..ec163ed3488 100644 --- a/app/_how-tos/gateway/enable-saml-authentication-with-microsoft-entra.md +++ b/app/_how-tos/gateway/enable-saml-authentication-with-microsoft-entra.md @@ -109,9 +109,10 @@ We also need to provide a value for [`config.session_secret`](/plugins/saml/refe {:.danger} > This example keeps [`validate_assertion_signature`](/plugins/saml/reference/#schema--config-validate-assertion-signature) at its default value of `true`, which requires a valid `idp_certificate`. > The plugin validates the SAML response signature whenever you configure an `idp_certificate`, even if you set `validate_assertion_signature` to `false`. +>

> The plugin skips signature validation only when `validate_assertion_signature` is `false` and no `idp_certificate` is set. It then accepts unsigned responses and logs a warning. -> This state is **not secure** — an attacker can impersonate any user. Always set `idp_certificate`. Never disable signature validation in production. - +> This state is **not secure**, as an attacker can impersonate any user. +> Always set `idp_certificate`. Never disable signature validation in production. {% entity_examples %} entities: plugins: diff --git a/app/_kong_plugins/saml/index.md b/app/_kong_plugins/saml/index.md index 188aa92f4a4..d779b3dd43c 100644 --- a/app/_kong_plugins/saml/index.md +++ b/app/_kong_plugins/saml/index.md @@ -77,7 +77,7 @@ The minimum configuration required is: {:.warning} > The plugin validates the SAML response signature whenever you set `idp_certificate`, even when [`validate_assertion_signature`](/plugins/saml/reference/#schema--config-validate-assertion-signature) is `false`. -> If you set `validate_assertion_signature` to `false` and configure no `idp_certificate`, the plugin skips signature validation and accepts unsigned responses, which is insecure. Always set `idp_certificate`. +> If you set `validate_assertion_signature` to `false` and don't configure `idp_certificate`, the plugin skips signature validation and accepts unsigned responses, which is insecure. Always set `idp_certificate`. The plugin currently supports SAML 2.0 with Microsoft Entra. Refer to the [Microsoft Entra SAML documentation](https://learn.microsoft.com/en-us/entra/architecture/auth-saml)