SAML needs to transform user ID sent by IdP into a valid dotCMS user ID

[john-thomas-dotcms]

Describe the bug

Customer reported issue: https://dotcms.zendesk.com/agent/tickets/102858

The SAML IdP can send a user ID which does not match dotCMS user ID format, and this ends up breaking some of our code. The customer that reported this issue has one SAML user that can not login to dotCMS using SAML because of this issue - they had to create a separate native login for this user.

To Reproduce

1. Create a SAML user on the IdP so that the user ID begins with a dash (-).
2. Attempt to login to dotCMS as that user (using SAML).
   Result: The user is unable to login, and errors are generated in the log file (see below).

Expected behavior

Users should be able to login to dotCMS using SAML, regardless of the format of the user ID provided by the IdP.

Log Messages

[05/11/20 15:44:57:346 GMT] WARN business.ESContentFactoryImpl: Elasticsearch error in index 'cluster_5fe28e94d3.working_20201029012155'
[05/11/20 15:44:57:346 GMT] WARN business.ESContentFactoryImpl: ES Query: {"size":10000,"timeout":"15000ms","query":{"query_string":{"query":"+contenttype:host +working:true +((+owner:-5bsj-fyzefxm7_wwdbsjvn3rweakf0jsi_cszm8vju +ownercanread:true) (permissions:p02088e05-5ff5-43c2-a4fa-11a7272cb199.1p* permissions:p11018493-4378-4cf5-9990-a255ff5d37a7.1p* permissions:p2e53a48f-78bd-4ef5-aad6-794477c02cba.1p* permissions:p62a0d22c-98e1-4e37-9288-d9231a7f2f39.1p* ) )","fields":[],"type":"best_fields","default_operator":"or","max_determinized_states":10000,"enable_position_increments":true,"fuzziness":"AUTO","fuzzy_prefix_length":0,"fuzzy_max_expansions":50,"phrase_slop":0,"escape":false,"auto_generate_synonyms_phrase_query":true,"fuzzy_transpositions":true,"boost":1.0}},"_source":{"includes":["inode","identifier"],"excludes":[]},"sort":[{"moddate":{"order":"desc"}}]}
[05/11/20 15:44:57:346 GMT] WARN business.ESContentFactoryImpl: Class org.elasticsearch.ElasticsearchStatusException: Elasticsearch exception [type=parse_exception, reason=parse_exception: Encountered " "-" "- "" at line 1, column 42.
Was expecting one of:
<BAREOPER> ...
"(" ...
"*" ...
<QUOTED> ...
<TERM> ...
<PREFIXTERM> ...
<WILDTERM> ...
<REGEXPTERM> ...
"[" ...
"{" ...
<NUMBER> ...
]
[05/11/20 15:44:57:346 GMT] WARN business.ESContentFactoryImpl: ----------------------------------------------

Additional context

• Although this specific issue was caused by a dash in front of the user ID, it's possible that IdPs might create user IDs in other formats that could break our code.
  • So we really need to have a standard way of ensuring that all user IDs provided by the IdP are transformed (if necessary) into a valid dotCMS user ID.

[wezell]

Here is the sequence:

• Lookup by userId unhashed
• Lookup by email unhashed
• Lookup by userId hashed
• create user with hashed userId

[erickgonzalez]

PR: #19801

[jcastro-dotcms]

The official code changes have been included in the dotCMS 5.3.8.4 LTS release only. The 5.2.8.4 LTS release is several commits behind, which made the code back-port not possible.

[erickgonzalez]

Fixed... now users on SAML are created using the userID hashed to avoid dash - at the beginning.

[bryanboza]

Fixed, tested with SAML in a local configuration and now works as expected. Tested on release-21.03 // Postgres // FF