Persist SAML entityID for the default identity zone during bootstrap - #4031
Merged
Conversation
GET /identity-zones/uaa omits the SAML entityID because the bootstrap flow that configures the default zone never persists login.entityID into SamlConfig, even though it is read into a separate runtime bean. This test captures the gap; it currently fails.
login.entityID was only ever read into a standalone runtime bean used for SAML metadata generation; it was never written to the default zone's SamlConfig, so GET /identity-zones/uaa omitted entityID even though it was configured. Bind login.entityID into IdentityZoneConfigurationBootstrap the same way issuer is handled, and persist it on the zone's SamlConfig when present.
Contributor
There was a problem hiding this comment.
Pull request overview
This PR ensures the default (uaa) identity zone persists the configured SAML SP entityID during bootstrap so it’s visible via zone retrieval APIs (e.g., GET /identity-zones/uaa) and consistent with how SAML metadata generation already reads login.entityID at runtime.
Changes:
- Adds MockMvc coverage verifying SAML
entityIDand signing flags are persisted for created zones and populated for the default zone from bootstrap YAML. - Extends
IdentityZoneConfigurationBootstrapwiring to acceptlogin.entityIDand persist it into the default zone’sSamlConfigwhen set. - Adds bootstrap unit tests for
login.entityIDhandling (set / null / empty).
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| uaa/src/test/java/org/cloudfoundry/identity/uaa/mock/zones/IdentityZoneEndpointsMockMvcTests.java | Adds endpoint-level regression tests covering SAML entityID + signing flags persistence and default-zone bootstrap population. |
| server/src/test/java/org/cloudfoundry/identity/uaa/config/IdentityZoneConfigurationBootstrapTests.java | Adds unit tests validating bootstrap behavior for SAML entityID (present vs null/empty). |
| server/src/main/java/org/cloudfoundry/identity/uaa/SpringServletXmlBeansConfiguration.java | Wires login.entityID into the bootstrap bean alongside existing login SAML properties. |
| server/src/main/java/org/cloudfoundry/identity/uaa/impl/config/IdentityZoneConfigurationBootstrap.java | Persists login.entityID into the default zone SamlConfig when non-blank. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
fhanik
approved these changes
Aug 13, 2026
cf-foundation-community-automation
Bot
moved this to Inbox
in Foundational Infrastructure Working Group
github-project-automation
Bot
moved this from Inbox
to Pending Merge | Prioritized
in Foundational Infrastructure Working Group
github-project-automation
Bot
moved this from Pending Merge | Prioritized
to Done
in Foundational Infrastructure Working Group
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
GET /identity-zones/uaaomits the SAMLentityIDbecause the bootstrap flow for the default zone never persistslogin.entityIDintoSamlConfig, even though a separate runtime bean reads it for SAML metadata generation.login.entityIDintoIdentityZoneConfigurationBootstrap(mirroring howissueris already handled) and persists it on the zone'sSamlConfigwhen present.Test plan
IdentityZoneConfigurationBootstrapTests(newsamlEntityIdConfiguration*tests + full suite) passIdentityZoneEndpointsMockMvcTestsfull suite passes, including the newdefaultZoneSamlConfig_isPopulatedFromBootstrapYamlandcreateZoneWithSamlConfig_entityIdAndSigningFlagsArePersistedprovider.saml.*server tests pass (confirms no change to actual SAML runtime behavior, since the two runtime consumers ofSamlConfig.getEntityID()already bypass the default zone)IdentityZoneEndpointDocsREST-docs tests pass🤖 Generated with Claude Code