fix: detect ADFS when IdpDescriptorURL has no trailing slash (#36333)

* fix: detect ADFS when IdpDescriptorURL has no trailing slash

The ADFS detection in detectSAMLProviderType was checking for "/adfs/"
(with trailing slash) but standard ADFS IdpDescriptorURL values often
end with just "/adfs" (e.g. https://adfs.company.com/adfs), causing the
provider type to show as "unknown" in support packets.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix: lowercase FederationMetadata pattern for case-insensitive matching

The normalizedURL is already lowercased, so comparing against the mixed-case
literal "/FederationMetadata/" made that branch unreachable.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
Ben Schumacher
2026-04-30 10:46:44 +02:00
committed by GitHub
co-authored by Claude Sonnet 4.6
parent 4da11e81af
commit ba9c96a354
2 changed files with 6 additions and 1 deletions
@@ -432,7 +432,7 @@ func detectSAMLProviderType(idpDescriptorURL string) string {
return "Centrify"
case strings.Contains(normalizedURL, "/realms/"):
return "Keycloak"
case strings.Contains(normalizedURL, "/adfs/") || strings.Contains(normalizedURL, "/FederationMetadata/"):
case strings.Contains(normalizedURL, "/adfs") || strings.Contains(normalizedURL, "/federationmetadata/"):
return "ADFS"
case strings.Contains(normalizedURL, "shibboleth.net") || strings.Contains(normalizedURL, "/idp/shibboleth"):
return "Shibboleth"
@@ -782,6 +782,11 @@ func TestDetectSAMLProviderType(t *testing.T) {
idpDescriptorURL: "https://localhost/adfs/services/trust",
expectedProvider: "ADFS",
},
{
name: "ADFS provider with bare /adfs path (no trailing slash)",
idpDescriptorURL: "https://adfs.company.com/adfs",
expectedProvider: "ADFS",
},
{
name: "Azure AD provider with login.microsoftonline.com",
idpDescriptorURL: "https://login.microsoftonline.com/12345/saml2",