CRITICAL: Nil pointer dereference in identity_provider.go createJITUser

[poyrazK]

Why is this an issue?

In internal/core/services/identity_provider.go:315-322, if both GetDefaultTenant() and CreateTenant() fail, accessing tenant.ID causes a nil pointer panic.

What is causing it?

tenant, err := s.tenantSvc.GetDefaultTenant(ctx)
if err != nil {
    tenant, err = s.tenantSvc.CreateTenant(ctx, "Default Tenant", ...)
}
if err != nil {
    return nil, apperrors.Wrap(...)
}
tenantID = tenant.ID  // PANIC if both calls failed

How can it be solved?

Add nil check for tenant after both operations.

Category

• Small
• Medium
• Large

Severity

• Low
• Medium
• High
• Critical