RocketChat / RocketChat/Rocket.Chat
[Bug]: SAML + IdP MFA loop in the new 8.8.0 system-browser sign-in flow
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 46.1k
- Forks
- 13.9k
- Avg merge
- 3d 3h
- Merged PRs (30d)
- 130
Description
Description
Rocket.Chat 8.8.0 introduced a new system-browser-based sign-in flow for SAML on mobile. When the Identity Provider enforces a 2FA step as part of its SAML assertion (e.g., Okta, Azure AD with Conditional Access), the deep-link callback (rocketchat://auth) that the app listens for is never triggered after a multi-redirect IdP flow. Users complete IdP 2FA in the browser but the app never receives the session token — they're stuck in an infinite login loop.
Steps to Reproduce
- Configure SAML to an IdP that enforces MFA (Okta, Azure AD)
- On mobile 8.8.0+ server, tap "Sign in with SSO"
- Complete IdP username + 2FA in system browser
- Observe: app never receives auth callback — returns to login screen
Why it's NEW
System-browser SAML is brand-new in 8.8.0 (Sep 2026). Multi-step IdP redirect regression has not been reported against this new architecture.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Reproduce the SAML sign-in flow from the mobile “Sign in with SSO” entry point using an IdP that requires MFA. Start by tracing the new 8.8.0 system-browser flow through the rocketchat://auth deep-link callback across the multi-redirect sequence. Done means the app receives the authentication result after IdP 2FA and no longer returns to the login screen.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- authentication, mobile
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100