RocketChat / RocketChat/Rocket.Chat
SAML username mapping is not working
@pierre-lehnen-rc is already working on this.
Since Jan 27, 2021.
- Dominant language
- TypeScript
- Stars
- 46.1k
- Forks
- 13.9k
- Avg merge
- 3d 3h
- Merged PRs (30d)
- 130
Description
Description:
When username is mapped to a SAML field, it is ignored, and another username is created, not even related to a SAML field.
Steps to reproduce:
-
Configure SAML mapping for username:
{"username":"urn:oid:1-2-840-113556-1-4-656", "name":"urn:oid:2-5-4-31", "email":"urn:oid:0-9-2342-19200300-100-1-3"} -
Connect user with SSO and check RocketChat behavior (full logs below)
Expected behavior:
username should be the value selected in the mapping
Actual behavior:
username is configured I don't know how, it's name.firstname but it must be constructed in some way, since it does not appear in the SAML response, not even in the email.
Server Setup Information:
- Version of Rocket.Chat Server: 3.10.3
- Operating System: Ubuntu
- Deployment Method: Helm chart
- Number of Running Instances: 1
- MongoDB Version: 4.0.3
Some SAML settings:
- Generate username: true (if not set, RocketChat asks the user to define his username, by default being
doe.john) - Normalize username : No normalization
- Immutable fieldname: username
- Overwrite user fullname (use idp attribute): true
- Overwrite user mail (use idp attribute): true
Relevant logs:
Field mapping is the following, so username should be mapped to urn:oid:1-2-840-113556-1-4-656
{"username":"urn:oid:1-2-840-113556-1-4-656", "name":"urn:oid:2-5-4-31", "email":"urn:oid:0-9-2342-19200300-100-1-3"}
At creation time, SAML response includes correct fields. urn:oid:1-2-840-113556-1-4-656 is MRJD27
I20210126-16:42:08.533(0) server.js:204 steffo:meteor-accounts-saml ➔ info RESULT :{"profile":{"inResponseToId":"id-anPnRnxMTfjyu8TD3","issuer":"https://sign-on.my-domain.com/idp/shibboleth","nameID":"john.doe@my-domain.com","nameIDFormat":"urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress","sessionIndex":"_d3b8257597316a4faf8e95b5172bc5b9","mail":"john.doe@my-domain.com","email":"john.doe@my-domain.com","urn:oid:0-0-10-15":"USER","urn:oid:1-2-840-113556-1-4-656":"MRJD27","urn:oid:2-5-4-31":"DOE John","urn:oid:2-5-4-4":"Doe","urn:oid:2-5-4-42":"John","urn:oid:0-9-2342-19200300-100-1-3":"john.doe@my-domain.com"}}
Mapping is checked by RC, everything is fine
I20210126-16:42:08.534(0) server.js:204 steffo:meteor-accounts-saml ➔ info parsed userDataMap { customFields: Map {}, attributeList: Set { 'urn:oid:1-2-840-113556-1-4-656', 'urn:oid:2-5-4-31', 'urn:oid:0-9-2342-19200300-100-1-3' }, email: { fieldName: 'urn:oid:0-9-2342-19200300-100-1-3' }, username: { fieldName: 'urn:oid:1-2-840-113556-1-4-656' }, name: { fieldName: 'urn:oid:2-5-4-31' }, identifier: { type: 'username' } }
Then user is created, but username is not the expected value.
I20210126-16:42:08.558(0) server.js:204 Integrations ➔ Outgoing WebHook.debug Got the event arguments for the event: userCreated { event: 'userCreated', user: { _id: 'ZQhvmhu8rY4HLn9pm', createdAt: 2021-01-26T16:42:08.539Z, name: 'DOE John', active: true, emails: [ [Object] ], services: { saml: [Object] }, username: 'doe.john', type: 'user', status: 'offline', _updatedAt: 2021-01-26T16:42:08.539Z } }
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.