fix shibboleth misconfigurations resulting in authentication bypass

changelogs/unreleased/fix-shibboleth-auth-with-no-uid.yml

+---
+title: fix shibboleth misconfigurations resulting in authentication bypass
+merge_request: 7428
+author: 

config/initializers/devise.rb

@@ -254,6 +254,10 @@ Devise.setup do |config|
         end
       end
 
+      if provider['name'] == 'shibboleth'
+        provider['args'][:fail_with_empty_uid] = true
+      end
+
       # A Hash from the configuration will be passed as is.
       provider_arguments << provider['args'].symbolize_keys
     end