Merge branch 'fix-shibboleth-auth-with-no-uid' into 'master'

fix shibboleth misconfigurations resulting in authentication bypass

This merge request fixes #22267 where a misconfigured Shibboleth `HTTP_UID` or `HTTP_EPPN` could result in users being logged into an account that did not belong to them.

See merge request !7428

1 files changed, 4 insertions, 0 deletions

diff --git a/config/initializers/devise.rb b/config/initializers/devise.rb
index f06c4d4ecf2..a8afc36fc78 100644
--- a/config/initializers/devise.rb
+++ b/config/initializers/devise.rb
@@ -241,6 +241,10 @@ Devise.setup do |config|
         end
       end
 
+      if provider['name'] == 'shibboleth'
+        provider['args'][:fail_with_empty_uid] = true
+      end
+
       # A Hash from the configuration will be passed as is.
       provider_arguments << provider['args'].symbolize_keys
     end