SAML enabled UAA prohibits local account logins about bosh-cli HOT 8 CLOSED

On Dec 1, 2016, at 8:17 AM, Steven Harms ***@***.***> wrote: If the BOSH UAA component has SAML configuration, there is no way to locally authenticate against UAA. The workflow causes a range prompts call to set a UI AskForPassword which will require a not null entry. Because the entry is not null, BOSH will force UAA to use SAML as the code was provided. Users should be able to login with a local account, even in the presence of SAML. — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub, or mute the thread.

+sree interesting. this sounds like a security feature in uaa -- can only use one source of users. can you auth as local user via uaac when saml is on? even if not, cli follows prompts abstraction established by uaa (dunno and dont care what im asking, just collect user responses and forward them), so if uaa does allow auth from multiple sources (local and users) it should validate necessary prompts in the uaa server (so still transparent to bosh cli). ie if saml field is empty assume its local user or something like that. or provide a better categorization of prompts so that cli can only show a subset. Sent from my iPhone On Dec 1, 2016, at 8:17 AM, Steven Harms ***@***.***> wrote: If the BOSH UAA component has SAML configuration, there is no way to locally authenticate against UAA. The workflow causes a range prompts call to set a UI AskForPassword which will require a not null entry. Because the entry is not null, BOSH will force UAA to use SAML as the code was provided. Users should be able to login with a local account, even in the presence of SAML. — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#59>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AALV95ytn8FCkrgKzTPkapTUReBIxS7Gks5rDvMmgaJpZM4LBlcK> .