Description

Detects n8n instances whose license grants single sign-on through SAML or OIDC while users still sign in with passwords that n8n keeps. Those passwords live outside the identity provider, so its sign-in policies, such as multi-factor authentication, do not apply to them, and removing a person from the identity provider does not remove their n8n account, which keeps access to every workflow and credential it can use.

Detection Strategy

• Reads the license grants, the login switches and the sign-in method of the instance from its public settings, which answer without the API key, in the same read the user rule makes

• Reports one vulnerability for the instance when the license grants SAML or OIDC and the sign-in method is not a protocol whose login is enabled; a SAML, OIDC or LDAP sign-in whose login is enabled is compliant, an instance whose license grants neither SAML nor OIDC is compliant, so a finding closes when the license lapses, and with single sign-on in use n8n still lets the owner sign in with a password, which the user rule holds to multi-factor authentication

• Records in the evidence the sign-in method and, for SAML, OIDC and LDAP, whether the license grants it and whether its login is enabled, never the login label or URL the instance writes; when the settings cannot be read or lack one of these fields, the rule is recorded as unreadable rather than reported as clean