RocketChat / RocketChat/Rocket.Chat

SAML username mapping is not working

Open
#20,422 2 comments 3 reactions 1 assignee View on GitHub

@pierre-lehnen-rc is already working on this.

Since Jan 27, 2021.

Dominant language
TypeScript
Stars
46.1k
Forks
13.9k
Avg merge
3d 3h
Merged PRs (30d)
130

Description

Description:

When username is mapped to a SAML field, it is ignored, and another username is created, not even related to a SAML field.

Steps to reproduce:
  1. Configure SAML mapping for username:
    {"username":"urn:oid:1-2-840-113556-1-4-656", "name":"urn:oid:2-5-4-31", "email":"urn:oid:0-9-2342-19200300-100-1-3"}

  2. Connect user with SSO and check RocketChat behavior (full logs below)

Expected behavior:

username should be the value selected in the mapping

Actual behavior:

username is configured I don't know how, it's name.firstname but it must be constructed in some way, since it does not appear in the SAML response, not even in the email.

Server Setup Information:
  • Version of Rocket.Chat Server: 3.10.3
  • Operating System: Ubuntu
  • Deployment Method: Helm chart
  • Number of Running Instances: 1
  • MongoDB Version: 4.0.3

Some SAML settings:

  • Generate username: true (if not set, RocketChat asks the user to define his username, by default being doe.john)
  • Normalize username : No normalization
  • Immutable fieldname: username
  • Overwrite user fullname (use idp attribute): true
  • Overwrite user mail (use idp attribute): true
Relevant logs:

Field mapping is the following, so username should be mapped to urn:oid:1-2-840-113556-1-4-656

{"username":"urn:oid:1-2-840-113556-1-4-656", "name":"urn:oid:2-5-4-31", "email":"urn:oid:0-9-2342-19200300-100-1-3"}

At creation time, SAML response includes correct fields. urn:oid:1-2-840-113556-1-4-656 is MRJD27

I20210126-16:42:08.533(0) server.js:204 steffo:meteor-accounts-saml ➔ info RESULT :{"profile":{"inResponseToId":"id-anPnRnxMTfjyu8TD3","issuer":"https://sign-on.my-domain.com/idp/shibboleth","nameID":"john.doe@my-domain.com","nameIDFormat":"urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress","sessionIndex":"_d3b8257597316a4faf8e95b5172bc5b9","mail":"john.doe@my-domain.com","email":"john.doe@my-domain.com","urn:oid:0-0-10-15":"USER","urn:oid:1-2-840-113556-1-4-656":"MRJD27","urn:oid:2-5-4-31":"DOE John","urn:oid:2-5-4-4":"Doe","urn:oid:2-5-4-42":"John","urn:oid:0-9-2342-19200300-100-1-3":"john.doe@my-domain.com"}} 

Mapping is checked by RC, everything is fine

I20210126-16:42:08.534(0) server.js:204 steffo:meteor-accounts-saml ➔ info parsed userDataMap {   customFields: Map {},   attributeList: Set {     'urn:oid:1-2-840-113556-1-4-656',     'urn:oid:2-5-4-31',     'urn:oid:0-9-2342-19200300-100-1-3'   },   email: { fieldName: 'urn:oid:0-9-2342-19200300-100-1-3' },   username: { fieldName: 'urn:oid:1-2-840-113556-1-4-656' },   name: { fieldName: 'urn:oid:2-5-4-31' },   identifier: { type: 'username' } }

Then user is created, but username is not the expected value.

I20210126-16:42:08.558(0) server.js:204 Integrations ➔ Outgoing WebHook.debug Got the event arguments for the event: userCreated {   event: 'userCreated',   user: {     _id: 'ZQhvmhu8rY4HLn9pm',     createdAt: 2021-01-26T16:42:08.539Z,     name: 'DOE John',     active: true,     emails: [ [Object] ],     services: { saml: [Object] },     username: 'doe.john',     type: 'user',     status: 'offline',     _updatedAt: 2021-01-26T16:42:08.539Z   } } 

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.