Fix SAML authentication when redirect port is occupied - #413
Open
cloudsmith-iduffy wants to merge 1 commit into
Open
Fix SAML authentication when redirect port is occupied#413cloudsmith-iduffy wants to merge 1 commit into
cloudsmith-iduffy wants to merge 1 commit into
Conversation
cloudsmith-iduffy
force-pushed
the
cloudsmith-iduffy-redirect-port-fallback
branch
from
September 4, 2026 12:41
dc8fd68 to
07dd0ac
Compare
Contributor
There was a problem hiding this comment.
Pull request overview
Fixes CLI SAML authentication failures when the default localhost callback port is already in use by probing a small port range, binding the callback server before fetching the IdP URL, and passing the selected redirect URL through to the backend.
Changes:
- Add redirect URL support to
get_idp_url()so the backend can return an IdP URL tied to the chosen callback port. - Update the
authenticatecommand to try ports 12400–12404 and always close the local callback server after success/failure. - Extend auth/SAML tests to cover redirect URL wiring and occupied-port behavior.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
| cloudsmith_cli/cli/commands/auth.py | Probe a port range for the local callback server, pass selected redirect URL to SAML flow, and ensure server closure. |
| cloudsmith_cli/cli/saml.py | Allow callers to specify redirect_url when retrieving the IdP redirect URL. |
| cloudsmith_cli/cli/tests/commands/test_auth.py | Add tests verifying port probing behavior and redirect URL selection. |
| cloudsmith_cli/cli/tests/test_saml.py | Update tests to pass redirect_url to get_idp_url(). |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
cloudsmith-iduffy
force-pushed
the
cloudsmith-iduffy-redirect-port-fallback
branch
from
September 4, 2026 13:11
07dd0ac to
8f5d3c8
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
SAML authentication currently fails when local callback port 12400 is occupied. This change tries ports 12400 through 12404 in order, binds the callback server before requesting the IDP URL, and sends the selected redirect URL to the backend so authentication can continue without user intervention.
The callback server is also closed reliably after authentication or an IDP request failure. Backend allowlisting is required for
http://localhost:12401throughhttp://localhost:12404.Type of Change
Additional Notes
Linear: ENG-14026