[NEW] Expand SAML Users Role Settings (#15277)

RocketChat · Sep 19, 2019 · 94b67b0 · 94b67b0
1 parent 1db06a5
commit 94b67b0
Show file tree

Hide file tree

Showing 3 changed files with 35 additions and 2 deletions.
diff --git a/app/meteor-accounts-saml/server/saml_rocketchat.js b/app/meteor-accounts-saml/server/saml_rocketchat.js
@@ -160,6 +160,22 @@ Meteor.methods({
 			section: name,
 			i18nLabel: 'SAML_Custom_Authn_Context',
 		});
+
+		settings.add(`SAML_Custom_${ name }_default_user_role`, 'user', {
+			type: 'string',
+			group: 'SAML',
+			section: name,
+			i18nLabel: 'SAML_Default_User_Role',
+			i18nDescription: 'SAML_Default_User_Role_Description',
+		});
+
+		settings.add(`SAML_Custom_${ name }_role_attribute_name`, '', {
+			type: 'string',
+			group: 'SAML',
+			section: name,
+			i18nLabel: 'SAML_Role_Attribute_Name',
+			i18nDescription: 'SAML_Role_Attribute_Name_Description',
+		});
 	},
 });
 
@@ -192,6 +208,8 @@ const getSamlConfigs = function(service) {
 		issuer: settings.get(`${ service.key }_issuer`),
 		logoutBehaviour: settings.get(`${ service.key }_logout_behaviour`),
 		customAuthnContext: settings.get(`${ service.key }_custom_authn_context`),
+		defaultUserRole: settings.get(`${ service.key }_default_user_role`),
+		roleAttributeName: settings.get(`${ service.key }_role_attribute_name`),
 		secret: {
 			privateKey: settings.get(`${ service.key }_private_key`),
 			publicCert: settings.get(`${ service.key }_public_cert`),
@@ -231,6 +249,8 @@ const configureSamlService = function(samlConfigs) {
 	Accounts.saml.settings.usernameField = samlConfigs.usernameField;
 	Accounts.saml.settings.usernameNormalize = samlConfigs.usernameNormalize;
 	Accounts.saml.settings.debug = samlConfigs.debug;
+	Accounts.saml.settings.defaultUserRole = samlConfigs.defaultUserRole;
+	Accounts.saml.settings.roleAttributeName = samlConfigs.roleAttributeName;
 
 	return {
 		provider: samlConfigs.clientConfig.provider,
@@ -241,6 +261,8 @@ const configureSamlService = function(samlConfigs) {
 		privateCert,
 		privateKey,
 		customAuthnContext: samlConfigs.customAuthnContext,
+		defaultUserRole: samlConfigs.defaultUserRole,
+		roleAttributeName: samlConfigs.roleAttributeName,
 	};
 };
 

diff --git a/app/meteor-accounts-saml/server/saml_server.js b/app/meteor-accounts-saml/server/saml_server.js
@@ -129,7 +129,7 @@ Accounts.registerLoginHandler(function(loginRequest) {
 		};
 	}
 
-	const { emailField, usernameField } = Accounts.saml.settings;
+	const { emailField, usernameField, defaultUserRole = 'user', roleAttributeName } = Accounts.saml.settings;
 
 	if (loginResult && loginResult.profile && loginResult.profile.email) {
 		const emailList = Array.isArray(loginResult.profile[emailField]) ? loginResult.profile[emailField] : [loginResult.profile[emailField]];
@@ -177,12 +177,19 @@ Accounts.registerLoginHandler(function(loginRequest) {
 			verified: true,
 		}));
 
+		let globalRoles;
+		if (roleAttributeName && loginResult.profile[roleAttributeName]) {
+			globalRoles = [].concat(loginResult.profile[roleAttributeName]);
+		} else {
+			globalRoles = [].concat(defaultUserRole.split(','));
+		}
+
 		if (!user) {
 			const newUser = {
 				name: fullName,
 				active: true,
 				eppn: eduPersonPrincipalName,
-				globalRoles: ['user'],
+				globalRoles,
 				emails,
 			};
 

diff --git a/packages/rocketchat-i18n/i18n/en.i18n.json b/packages/rocketchat-i18n/i18n/en.i18n.json
@@ -2680,6 +2680,10 @@
   "SAML_Custom_Immutable_Property_Username": "Username",
   "SAML_Custom_Immutable_Property_EMail": "E-Mail",
   "SAML_Custom_Public_Cert": "Public Cert Contents",
+  "SAML_Default_User_Role": "Default User Role",
+  "SAML_Default_User_Role_Description": "You can specify multiple roles, separating them with commas.",
+  "SAML_Role_Attribute_Name": "Role Attribute Name",
+  "SAML_Role_Attribute_Name_Description": "If this attribute is found on the SAML response, it's values will be used as role names for new users.",
   "Saturday": "Saturday",
   "Save": "Save",
   "save-others-livechat-room-info": "Save Others Livechat Room Info",