SSO Bootstrap Bypass (PXY-6219)

Drives tungsten's IdP bootstrap gates without a real identity provider. This page plays the auth server's role and must be opened on a passthrough'd hostname (sso.caesium.menlotest.com) so an unauthenticated browser can reach it. The idp. and cdn. siblings are on tungsten's [[idp_bootstrap]] allowlist and are where the gates fire.

Page origin: . Test with an unauthenticated client (tenant-unknown, or tenant-known without a user session) — the gates close once authenticated.

Issuer (the deployment's login host; tungsten compares the AuthnRequest issuer against it) IdP base URL

not run

Expected outcomes (unauthenticated client)

Action	Expected	Gate
Start SSO	Fake IdP login page renders; probes PASS; credential POST completes	auth request, then login resource
Foreign issuer	Redirected to the auth server (or its error page) — no bypass	auth request rejects issuer
Login page without SAMLRequest	Auth redirect (no live grant) or renders (grant < 300s old)	login resource
CDN fetch without grant	BLOCKED (403); PASS while a grant is live	login resource, fail-closed

Verify dispositions in tungsten's access log: disposition=auth:idp_bootstrap (the pe block is absent: PE is never asked), and the requests_by_disposition_total{disposition="auth:idp_bootstrap"} counter.