[IMPROVE] SAML login process refactoring

[kukkjanos]

• the eppn is primary identifier match parameter (if not exist then email is a secondary)
• update eppn to user profile
• support the eduPersonPrincipalName (eppn) usually required saml parameter
• support the displayName optional saml parameter
• support two new saml settings
  • overwrite user fullname if need (use idp attribute [cn,username or displayName])
  • overwrite user mail address if need (use idp attribute)

FIX NEW DIRECTORY

Closes #ISSUE_NUMBER

[CLAassistant]

All committers have signed the CLA.

[misi]

+1

[rukverc]

This is a very useful feature, strongly recommended.

[EmiTrif]

+1

[northway]

+1

[rukverc]

Contains necessary changes, seems legit code.

[Toushe]

Good job!

[rAcHekLoS]

a) This change destroy SAML with Microsoft ADFS. The login works, but the user maps always to the User Rocket.Cat.
b) generally a problem is that you cannot configure the authnContext. To enable Kerberos or NTLM login, the app.js code must be modified.

May 29 16:43:40 x06-rocketchat rocketchat[17255]: { actionName: 'authorize',
May 29 16:43:40 x06-rocketchat rocketchat[17255]: serviceName: 'adfs',
May 29 16:43:40 x06-rocketchat rocketchat[17255]: credentialToken: 'id-x93vGuoAPjFWxtEtr' }
May 29 16:43:40 x06-rocketchat rocketchat[17255]: [ { provider: 'adfs',
May 29 16:43:40 x06-rocketchat rocketchat[17255]: entryPoint: 'https://adfs.edag.de/adfs/ls/',
May 29 16:43:40 x06-rocketchat rocketchat[17255]: idpSLORedirectURL: 'https://adfs.edag.de/adfs/ls/',
May 29 16:43:40 x06-rocketchat rocketchat[17255]: issuer: 'https://rocketchat.edag.de',
May 29 16:43:40 x06-rocketchat rocketchat[17255]: cert: '',
May 29 16:43:40 x06-rocketchat rocketchat[17255]: privateCert: false,
May 29 16:43:40 x06-rocketchat rocketchat[17255]: privateKey: false,
May 29 16:43:40 x06-rocketchat rocketchat[17255]: callbackUrl: 'https://rocketchat.edag.de/_saml/validate/adfs',
May 29 16:43:40 x06-rocketchat rocketchat[17255]: id: 'wvWk7Zjf1YnlDjEdn',
May 29 16:43:40 x06-rocketchat rocketchat[17255]: protocol: 'https://',
May 29 16:43:40 x06-rocketchat rocketchat[17255]: path: '/saml/consume',
May 29 16:43:40 x06-rocketchat rocketchat[17255]: identifierFormat: 'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress',
May 29 16:43:40 x06-rocketchat rocketchat[17255]: authnContext: 'urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport' } ]
May 29 16:43:40 x06-rocketchat rocketchat[17255]: adfs
May 29 16:43:40 x06-rocketchat rocketchat[17255]: { actionName: 'validate',
May 29 16:43:40 x06-rocketchat rocketchat[17255]: serviceName: 'adfs',
May 29 16:43:40 x06-rocketchat rocketchat[17255]: credentialToken: undefined }
May 29 16:43:40 x06-rocketchat rocketchat[17255]: [ { provider: 'adfs',
May 29 16:43:40 x06-rocketchat rocketchat[17255]: entryPoint: 'https://adfs.edag.de/adfs/ls/',
May 29 16:43:40 x06-rocketchat rocketchat[17255]: idpSLORedirectURL: 'https://adfs.edag.de/adfs/ls/',
May 29 16:43:40 x06-rocketchat rocketchat[17255]: issuer: 'https://rocketchat.edag.de',
May 29 16:43:40 x06-rocketchat rocketchat[17255]: cert: '',
May 29 16:43:40 x06-rocketchat rocketchat[17255]: privateCert: false,
May 29 16:43:40 x06-rocketchat rocketchat[17255]: privateKey: false,
May 29 16:43:40 x06-rocketchat rocketchat[17255]: callbackUrl: 'https://rocketchat.edag.de/_saml/validate/adfs',
May 29 16:43:40 x06-rocketchat rocketchat[17255]: id: 'id-x93vGuoAPjFWxtEtr',
May 29 16:43:40 x06-rocketchat rocketchat[17255]: protocol: 'https://',
May 29 16:43:40 x06-rocketchat rocketchat[17255]: path: '/saml/consume',
May 29 16:43:40 x06-rocketchat rocketchat[17255]: identifierFormat: 'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress',
May 29 16:43:40 x06-rocketchat rocketchat[17255]: authnContext: 'urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport' } ]
May 29 16:43:40 x06-rocketchat rocketchat[17255]: adfs
May 29 16:43:40 x06-rocketchat rocketchat[17255]: RESULT :{"profile":{"inResponseToId":"id-x93vGuoAPjFWxtEtr","issuer":"http://adfs.edag.de/adfs/services/trust","nameID":"xxxxx@xxxx.com","nameIDFormat":"urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress","sessionIndex":"_e4c81ddb-ddc0-49e4-bd51-36b501895c66","email":"xxxxx@xxxx.com","http://schemas-xmlsoap-org/ws/2005/05/identity/claims/name":"Test, Test","http://schemas-xmlsoap-org/ws/2005/05/identity/claims/emailaddress":"xxxxx@xxxx.com"}}

[Hudell]

Does it need a different authnContext value to work? What value would that be?

[rAcHekLoS]

request += '<samlp:RequestedAuthnContext xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" Comparison="exact">' + '<saml:AuthnContextClassRef xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">urn:federation:authentication:windows</saml:AuthnContextClassRef></samlp:RequestedAuthnContext>\n' + '</samlp:AuthnRequest>';

[isometry]

a) This change destroy SAML with Microsoft ADFS. The login works, but the user maps always to the User Rocket.Cat.

This change also breaks SAML with OneLogin IdP; same symptoms as reported here, but OneLogin does support the hard-coded authnContext of urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport

[Hudell]

You mean login working but with the wrong user? That was fixed by #14686 and included on the 1.1.1 hotfix release.

[isometry]

You mean login working but with the wrong user? That was fixed by #14686 and included on the 1.1.1 hotfix release.

Confirmed fixed. Thanks!

[rAcHekLoS]

The problem #14686 is fixed, THX.

For AuthContext, I would suggest that you make an array to specify multiple AuthContext. This way you can support multiple variants.