Uma, idpsession check, noredirects config check (#442)

gogatekeeper · Apr 4, 2024 · 77a991f · 77a991f
1 parent 8f32044
commit 77a991f
Show file tree

Hide file tree

Showing 3 changed files with 2 additions and 5 deletions.
diff --git a/e2e/e2e_uma_test.go b/e2e/e2e_uma_test.go
@@ -40,7 +40,6 @@ var _ = Describe("UMA Code Flow authorization", func() {
 			"--skip-access-token-issuer-check=true",
 			"--openid-provider-retry-count=30",
 			"--secure-cookie=false",
-			"--enable-idp-session-check=false",
 		}
 
 		osArgs = append(osArgs, proxyArgs...)
@@ -137,7 +136,6 @@ var _ = Describe("UMA Code Flow authorization with method scope", func() {
 			"--secure-cookie=false",
 			"--verbose=true",
 			"--enable-logging=true",
-			"--enable-idp-session-check=false",
 		}
 
 		osArgs = append(osArgs, proxyArgs...)
@@ -377,7 +375,6 @@ var _ = Describe("UMA Code Flow, NOPROXY authorization with method scope", func(
 			"--secure-cookie=false",
 			"--verbose=true",
 			"--enable-logging=true",
-			"--enable-idp-session-check=false",
 		}
 
 		osArgs = append(osArgs, proxyArgs...)

diff --git a/pkg/apperrors/apperrors.go b/pkg/apperrors/apperrors.go
@@ -140,7 +140,7 @@ var (
 		"only one type of external authz can be enabled at once",
 	)
 	ErrMissingClientCredsWithUMA        = errors.New("enable uma requires client credentials")
-	ErrEnableUmaIdpSessionCheckConflict = errors.New("you cannot have enable uma together with enable idp session check")
+	ErrEnableUmaIdpSessionCheckConflict = errors.New("you cannot have enable uma together with enable idp session check and noredirects")
 	ErrTooManyDefaultDenyOpts           = errors.New(
 		"only one of enable-default-deny/enable-default-deny-strict can be true",
 	)

diff --git a/pkg/keycloak/config/config.go b/pkg/keycloak/config/config.go
@@ -888,7 +888,7 @@ func (r *Config) isExternalAuthzValid() error {
 		if r.ClientID == "" || r.ClientSecret == "" {
 			return apperrors.ErrMissingClientCredsWithUMA
 		}
-		if r.EnableIDPSessionCheck {
+		if r.EnableIDPSessionCheck && r.NoRedirects {
 			return apperrors.ErrEnableUmaIdpSessionCheckConflict
 		}
 	} else if r.EnableOpa {