feat: support SAML okta login

[ebreak]

I have implemented all steps of SAML auth, and it can already sign in via SAML (Okta).

But there are still some problems.

1. I can not find any keyword to prove that the xml comes from SAML server

Okta Auth server redirected to Casdoor with a xml file like this:

<?xml version="1.0" encoding="UTF-8"?>
<saml2p:Response Destination="http://localhost:7001/" ID="id34511785908251771146679018" IssueInstant="2021-07-06T09:01:57.342Z" Version="2.0"
    xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol">
    <saml2:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity"
        xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">http://www.okta.com/exk77kxqxalhWrJJr695</saml2:Issuer>
    <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
        <ds:SignedInfo>
            <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
            <ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/>
            <ds:Reference URI="#id34511785908251771146679018">
                <ds:Transforms>
                    <ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
                    <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
                </ds:Transforms>
                <ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
                <ds:DigestValue>uVZVTw2oxC5CmVrq0HLLFfmOOccO2UZ9l/8B82T0K0s=</ds:DigestValue>
            </ds:Reference>
        </ds:SignedInfo>
        <ds:SignatureValue>J2kQ1aN0h+vCT52r6dpf2KrOrEcGikJs41cVudtmeEB5HZQ5wKY/ywCCKzoSMyLZ4/I+znmf9KMFjIk0va1cEeihdkxzf+ngZjGmhOPs0Ye127AnoW3a/t/i2Nez34cni3+yoF3vHEbCONzVvkH9VIJh3r0YMf5/AtHMuZjC+XTN1uqEuu8Sjv03SPZ+22aBWFMVHmneA++JbRL3mLOPIV8nFyKllJXfCBuuQwNdrqPZl/j02I+b7DJFSRzjcowE5PdYhiDu42LIy1+c6NE02xg3Vtly8bveY7Ni0EJfis0sAE0cGlDRVEx3cujbUMT/1N4rOQmYECEpQ/tjLiW+jw==</ds:SignatureValue>
        <ds:KeyInfo>
            <ds:X509Data>
                <ds:X509Certificate>
                    ...
                </ds:X509Certificate>
            </ds:X509Data>
        </ds:KeyInfo>
    </ds:Signature>
    <saml2p:Status xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol">
        <saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/>
    </saml2p:Status>
    <saml2:Assertion ID="id3451178590906809807497440" IssueInstant="2021-07-06T09:01:57.342Z" Version="2.0"
        xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">
        <saml2:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity"
            xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">
    http://www.okta.com/exk77kxqxalhWrJJr695
        </saml2:Issuer>
        <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
            <ds:SignedInfo>
                <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
                <ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/>
                <ds:Reference URI="#id3451178590906809807497440">
                    <ds:Transforms>
                        <ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
                        <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
                    </ds:Transforms>
                    <ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
                    <ds:DigestValue>Krvw4cHzgPstyrN/IaIbu1vke/+5vtoaofvSo7P2hKc=</ds:DigestValue>
                </ds:Reference>
            </ds:SignedInfo>
            <ds:SignatureValue>hNcYZT1LcWs38GaX9RDjtfirUhg9bIC6LFco9f7qHr6QbfymzyLRpaFV10otMrqi+1cqUcXTZcdW/ZbJiI5P+KjmKrGoVUc2DRZ9x62k4nyjcg/DNkg6TihYmKpxMcShjt1omI8tlnV4gAf4keAZQOOtOQ8otpfNWqm52vDKyIny+w+re+mlgIlS+yft+z11asJmHPnMkHv+Y7iVUbZZ2VkC4leYKFUDXHOGnZ6xpf+Sd2jWY02gdF5VDgWzhoyKM++gaBO/RrU8he2hATKgR5KlbW1CzsmYswR4WB6F6EM+ckysQ9dzrzUii+X7sM7k0SozqBRlw9/yZcfUS9JCQA==</ds:SignatureValue>
            <ds:KeyInfo>
                <ds:X509Data>
                    <ds:X509Certificate>
                        ...
                    </ds:X509Certificate>
                </ds:X509Data>
            </ds:KeyInfo>
        </ds:Signature>
        <saml2:Subject xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">
            <saml2:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified">me@mail.kininaru.dev</saml2:NameID>
            <saml2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
                <saml2:SubjectConfirmationData NotOnOrAfter="2021-07-06T09:06:57.342Z" Recipient="http://localhost:7001/"/>
            </saml2:SubjectConfirmation>
        </saml2:Subject>
        <saml2:Conditions NotBefore="2021-07-06T08:56:57.342Z" NotOnOrAfter="2021-07-06T09:06:57.342Z"
            xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">
            <saml2:AudienceRestriction>
                <saml2:Audience>saml-test</saml2:Audience>
            </saml2:AudienceRestriction>
        </saml2:Conditions>
        <saml2:AuthnStatement AuthnInstant="2021-07-06T09:00:55.974Z" SessionIndex="id1625562117341.45657483"
            xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">
            <saml2:AuthnContext>
                <saml2:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml2:AuthnContextClassRef>
            </saml2:AuthnContext>
        </saml2:AuthnStatement>
    </saml2:Assertion>
</saml2p:Response>

I can not find any keyword to prove that this request comes from the SAML server.

Anyone can write this xml, and send it to Casdoor to declare their identity.

2. SAML server will let browsers make POST requests when redirecting to Casdoor

React can not handle a POST request, so I made a new api /api/saml-callback in Go back-end to handle the redirection from a SAML server. And now it works fine.

But I wonder if this is a more suitable way to solve the situation...

This is a draft PR, because I want to get some suggestions...

Here is a video of the whole process.

2021-07-06.23-47-57.mp4