src/server/auth/server/saml.go
func (a *apiServer) updateConfig(config *auth.AuthConfig) error {
	if config == nil {
		config = &auth.AuthConfig{}
	}
	newConfig, err := validateConfig(config, internal)
	if err != nil {
		return err
	}

	// It's possible that 'config' is non-nil, but empty (this is the case when
	// users clear the config from the command line). Therefore, check
	// newConfig.IDP.Name != "" instead of config != nil.
	if newConfig.IDP.Name != "" {
		a.configCache = newConfig
		// construct SAML handler
		a.samlSP = &saml.ServiceProvider{
			Logger:      logrus.New(),
			IDPMetadata: a.configCache.IDP.Metadata,
			AcsURL:      *a.configCache.SAMLSvc.ACSURL,
			MetadataURL: *a.configCache.SAMLSvc.MetadataURL,

			// Not set:
			// Key: Private key for Pachyderm ACS. Unclear if needed
			// Certificate: Public key for Pachyderm ACS. Unclear if needed
			// ForceAuthn: (whether users need to re-authenticate with the IdP, even
			//             if they already have a session--leaving this false)
			// AuthnNameIDFormat: (format the ACS expects the AuthnName to be in)
			// MetadataValidDuration: (how long the SP endpoints are valid? Returned
			//                        by the Metadata service)
		}
		a.redirectAddress = a.configCache.SAMLSvc.DashURL // Set redirect address from config as well
	} else {
		a.configCache = nil
		a.samlSP = nil
		a.redirectAddress = nil
	}
	return nil
}
func (a *apiServer) updateConfig(config *auth.AuthConfig) error {
	if config == nil {
		config = &auth.AuthConfig{}
	}
	newConfig, err := validateConfig(config, internal)
	if err != nil {
		return err
	}

	// It's possible that 'config' is non-nil, but empty (this is the case when
	// users clear the config from the command line). Therefore, check
	// newConfig.IDP.Name != "" instead of config != nil.
	if newConfig.IDP.Name != "" {
		a.configCache = newConfig
		// construct SAML handler
		a.samlSP = &saml.ServiceProvider{
			Logger:      logrus.New(),
			IDPMetadata: a.configCache.IDP.Metadata,
			AcsURL:      *a.configCache.SAMLSvc.ACSURL,
			MetadataURL: *a.configCache.SAMLSvc.MetadataURL,

			// Not set:
			// Key: Private key for Pachyderm ACS. Unclear if needed
			// Certificate: Public key for Pachyderm ACS. Unclear if needed
			// ForceAuthn: (whether users need to re-authenticate with the IdP, even
			//             if they already have a session--leaving this false)
			// AuthnNameIDFormat: (format the ACS expects the AuthnName to be in)
			// MetadataValidDuration: (how long the SP endpoints are valid? Returned
			//                        by the Metadata service)
		}
		a.redirectAddress = a.configCache.SAMLSvc.DashURL // Set redirect address from config as well
	} else {
		a.configCache = nil
		a.samlSP = nil
		a.redirectAddress = nil
	}
	return nil
}
// updateConfig validates 'config', and if it valides successfully, loads it
// into the apiServer's config cache. The caller should already hold a.configMu
// and a.samlSPMu (as this updates a.samlSP)