[jtroup]

ENG-9236

what

Upgrade cryptography to 50.x and pyopenssl to 26.x, which clears
their High findings. These two can only move with the packages that
cap them:

• pysaml2 moves to 7.5.5. Every 7.5.x release has a pyopenssl cap,
  and 7.5.5 is the first one that allows 26.x.
• authlib moves to 1.8, which needs cryptography 45 or later.
• msal gets a minimum of 1.39, because earlier releases cap
  cryptography below 47.

pysaml2 7.5.5 caps xmlschema below 3, so the lockfile moves
xmlschema from 3.4 back to 2.5. Only pysaml2 uses it. The
lockfile also picks up newer cffi and joserfc.

New tests cover the SAML login routes. A test IdP signs assertions
with a generated key, and redash verifies them through the real
pysaml2 and xmlsec1 path. The tests check that sign-in starts with a
correct request to the IdP, that a valid assertion creates and logs
in the user with their groups, and that redash decrypts an encrypted
assertion with the SP key. They also check that redash rejects an
unsigned assertion and an assertion signed by another key.

why

Clear the High findings for cryptography and pyopenssl. Before
this change, no test covered saml_auth.py.

testing

This relies on the unit suite and the new SAML tests. Our deployments
sign in with Cognito JWTs, not SAML. The existing JWT tests cover the
cryptography calls on that path: loading a JWKS key and verifying
an RS256 token.

• Console login reaches Redash in a sandbox built from this
  branch

docs

No docs needed.

---

🤖 Generated with Claude Code

[jtroup]

@cubic-ai

[cubic-dev-ai]

@cubic-ai

@jtroup I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

No issues found across 3 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

Architecture diagram

sequenceDiagram
    participant Client as Web Browser
    participant Redash as Redash App
    participant SAML as SAML Auth Module
    participant Pysaml2 as pysaml2 Library
    participant XMLSec as xmlsec1 Binary
    participant Crypt as cryptography Library
    participant OpenSSL as pyOpenSSL
    participant IdP as External IdP
    participant DB as Database

    Note over Client,DB: SAML Authentication Flow with Upgraded Cryptography Stack

    Client->>Redash: GET /saml/login
    Redash->>SAML: Initiate SP-initiated SSO
    SAML->>Pysaml2: Create AuthnRequest
    Pysaml2->>Crypt: Sign request (RS256)
    Crypt->>OpenSSL: Cryptographic operations
    OpenSSL-->>Crypt: Signed output
    Crypt-->>Pysaml2: Signed AuthnRequest
    Pysaml2-->>SAML: Encoded SAMLRequest
    SAML-->>Redash: Redirect URL with SAMLRequest
    Redash-->>Client: 302 Redirect to IdP SSO URL

    Note over Client,IdP: User authenticates at IdP

    Client->>Redash: POST /saml/callback (SAMLResponse)
    Redash->>SAML: Process SAML response
    
    alt SAML disabled
        SAML-->>Redash: Redirect to login page
        Redash-->>Client: 302 Redirect
    end

    alt Valid signed assertion
        SAML->>Pysaml2: Verify assertion signature
        Pysaml2->>Crypt: Verify signature with IdP cert
        Crypt->>OpenSSL: RSA verification
        OpenSSL-->>Crypt: Verification result
        Crypt-->>Pysaml2: Valid signature
        Pysaml2-->>SAML: Verified assertion
        
        opt Encrypted assertion
            Pysaml2->>XMLSec: Decrypt assertion
            XMLSec->>Crypt: Decrypt with SP private key
            Crypt->>OpenSSL: RSA decryption
            OpenSSL-->>Crypt: Decrypted assertion
            Crypt-->>XMLSec: Decrypted data
            XMLSec-->>Pysaml2: Plaintext assertion
        end
        
        SAML->>DB: Find or create user by email
        DB-->>SAML: User record
        SAML->>DB: Update user groups
        DB-->>SAML: Updated user
        SAML-->>Redash: Authenticated user session
        Redash-->>Client: 302 Redirect to dashboard
        
    else Invalid signature (unsigned or wrong key)
        SAML->>Pysaml2: Attempt signature verification
        Pysaml2->>Crypt: Verify with IdP cert
        Crypt->>OpenSSL: RSA verification fails
        OpenSSL-->>Crypt: Invalid signature
        Crypt-->>Pysaml2: SignatureError
        Pysaml2-->>SAML: SignatureError
        SAML-->>Redash: Log error, redirect to login
        Redash-->>Client: 302 Redirect to login
    end

    Note over Crypt,OpenSSL: Upgraded versions (cryptography 50.x, pyOpenSSL 26.x)<br/>with CVE fixes, used via authlib, msal, and pysaml2

    Note over Redash,DB: JWT auth path also uses upgraded cryptography<br/>for JWKS key loading and RS256 verification

Loading

_{Re-trigger cubic}

[kevin-birkett]

thanks @jtroup