[NEW] Options for SAML auth for individual organizations needs

[Deltachaos]

Closes #6481

This PR fixes a problem with changed mail addresses for SAML logins by letting the admins to set if they want to identify the created Rocket.Chat user by ether "Username" or "E-Mail Address".

To increase the compatibility with various SAML providers, it also adds attribute mapping as many other SAML service provider already have implemented.

[CLAassistant]

All committers have signed the CLA.

[gerbsen]

hey there @ymybe, can we do something to help this MR get merged? I don't really understand why the last missing pipeline is on hold? Can we do something about this or is this cause the Rocket.Chat team needs to say "It's okay"? Cheers, Daniel

[anicoa]

@rodrigok sorry for bother you, but you helped already with #12153 ;)

Would it be possible to get this pr merged? it enhances the saml authentication system and i think mapping of attributes is a huge improvement. thanks a lot for your effort!

[Deltachaos]

@kukkjanos and @sampaiodiego You both have worked on the SAML component the recently. Do you have an opinion about this PR? What can we do to get this merged?

[sampaiodiego]

sorry the delay guys..

[Deltachaos]

@sampaiodiego have updated the PR

[Deltachaos]

@sampaiodiego is there a chance to get this into 1.3.0 stable?

[Deltachaos]

@sampaiodiego thanks for merging!

[BarnumD]

We have a staff id that never changes and I'm thinking about using that to identify the account in Rocket.Chat. But how? Would I map that field to 'username' in the saml configuration and select username as the immutable field name?
If I do that, Is the user's staff ID going to be visable in the rocket.chat interface.. For instance, when people try to mention someone using the @ symbol.
@Deltachaos

[Deltachaos]

@BarnumD jep thats correct :/ i have not thought about this case. I guess the best would be to add another option to the SAML configuration where you can enter an arbitrary id field and then adding an option to the "SAML__username_normalize" list.

As a workaround you can probably also let your SAML provider return the field eppn. This overrides all the other methods for finding the user. I guess this property is not used anywhere else.

[BarnumD]

Should I open a new issue since this one has been closed/merged?

[Deltachaos]

@BarnumD i guess yes. But it is not really hard to implement. Feel free to open a new PR.