- Jan 04, 2022
-
-
David Taylor authored
There is only one SAMLAuthenticator instance per-process. Storing user-specific state in it is risky (although, in our default unicorn-based config, is unlikely to cause issues because we only handle one concurrent request per process). This commit also updates our implementation to use the built-in `#single` and `#multi` methods provided by the SAML gem. This avoids the need for our custom `&.first`, `&.split` and `&.join` implementation.
-
- Dec 29, 2021
-
-
Andrei Prigorshnev authored
Starting from https://github.com/discourse/discourse/commit/c2022521906b3c44a8a21e8eb2527c8650e06a18 we can pass to `UsernameSuggester` an array of inputs parameters and it'll be skipping invalid items and trying next ones.
-
- Dec 23, 2021
-
-
David Taylor authored
-
- Dec 16, 2021
-
-
discoursebot authored
Co-authored-by:
CvX <CvX@users.noreply.github.com>
-
- Dec 15, 2021
-
-
David Taylor authored
The change in 245b70d4 means that the CSP middleware now activates for the `/auth/saml` route. That's good, but it also broke things for subfolder installations because the CSP includes the base_path, while the SAML script path did not. This commit fixes that, and adds an integration spec to ensure the script is included in the script_src directive for regular and subfolder sites.
-
David Taylor authored
In the vast majority of cases, this wasn't causing a problem because browsers will auto-detect the content-type. However, if any intermediate proxies add the `X-Content-Type-Options: nosniff` header, then the html will be displayed as plain text, and login will be broken.
-
David Taylor authored
The SAML spec requires compression for the standard Redirect binding. However, it is not used in the POST binding. This regressed during the refactoring of 95ccea3f
-
- Dec 13, 2021
-
-
David Taylor authored
-
- Dec 10, 2021
-
-
David Taylor authored
Some variable renames were missed, and some specs are no longer relevant
-
David Taylor authored
Core takes care of suggesting usernames during normal signup. Suggesting them here as well can cause unexpected issues (e.g. when staged users sign up). The SAML plugin currently has a bespoke `auto_create_account` implementation, which **does** need to do its own username suggestion. Therefore this commit moves all the suggestion logic into `auto_create_account`. An integration spec for staged-user signup is also introduced.
-
David Taylor authored
Regression introduced in e9f9150b
-
David Taylor authored
-
David Taylor authored
GlobalSettings configured via environment variables will continue to take precendence, so this change is backwards compatible. - `.presence` is added to string values, since 'unset' site settings are never `nil` - saml_force_domains is split on `|` and `,` because site settings expect a `|`, while the old global setting expected a `,` - Specs are migrated to use SiteSettings, because GlobalSettings do not override SiteSettings in test mode
-
David Taylor authored
Follow-up to d137e981. If the cross-site POST returns a Set-Cookie header, it will overwrite the existing session, and we'll lose the redirect URL. This commit instructs rack not to persist a session cookie in this response.
-
David Taylor authored
SAML flows end in a cross-site POST back to Discourse. We have the SameSite=lax attributes on our session cookies so this cross-site POST request has no cookies, and therefore we are unable to check any values in the `session`. This commit makes the browser re-submit the POST request in a SameSite context (i.e. with cookies). Upon receiving a cross-site POST, it renders a simple HTML form with some auto-submit JS. This form submits exactly the same data to the same URL, but this time the request will include the cookies, and authentication can complete properly
-
- Dec 09, 2021
-
-
David Taylor authored
The prefix is added by the helper. Adding it here causes it to be prefixed twice.
-
David Taylor authored
This centralises our logic for accessing settings. This particular commit should be a no-op. I intend to followup with the new site setting definitions in a future commit.
-
- Dec 08, 2021
-
-
David Taylor authored
This means that the name/title can be set per-site and per-locale. This change is backwards-compatible - any existing sites which have configured the GlobalSettings will use those cluster-wide.
-
David Taylor authored
Putting this logic into the omniauth strategy is much cleaner because: - we no longer need a Rails controller and the associated `custom_url` parameter - we can re-use the `authn_request` instance which is automatically generated by the omniauth strategy, rather than re-implementing that logic - the behavior is decided at runtime, rather than during initialization. This makes it testable, and is another step on the way to making the plugin multisite-compatible This commit also introduces a spec for the feature.
-
David Taylor authored
This will allow much easier testing of the strategy, and is one more step towards making the SAML plugin multisite-compatible
-
- Dec 07, 2021
-
-
David Taylor authored
For `name`, the previous intention was to use the `fullName` attribute, and then fallback to "firstname lastname". However, a bug in the implementation meant that the `fullName` was skipped. This commit updates the logic to lean on omniauth-saml's attribute_statements for the fullName, firstName and lastName attributes, and also updates the priority logic so that fullName is indeed prioritized.
-
- Dec 06, 2021
-
-
David Taylor authored
-
David Taylor authored
-
David Taylor authored
-
David Taylor authored
-
David Taylor authored
-
David Taylor authored
The styling no works with Discourse's current login UI, so let's remove it. The OnceOff job was to migrate from an old data format more than 4 years ago. It's exceptionally unlikely that anyone is going to upgrade from such an old version. If they do, they could still extract the data manually and migrate it.
-
- Oct 27, 2021
-
-
Bastien Le Querrec authored
Co-authored-by:
Bastien Le Querrec <blq@laquadrature.net>
-
- Oct 21, 2021
-
-
Andreas Teuber authored
If your IDP transmits `cn=groupname,cn=groups,dc=example,dc=com` you can set this to true to use only `groupname`. This is useful if you want to keep the standard group name length of Discourse (20 characters). Co-authored-by:
Andreas Teuber <andreas.teuber@passiv.de>
-
- Sep 27, 2021
-
-
Vinoth Kannan authored
Our hosted sites running in stable branch have issues with `rexml` gem and returning "missing gem" error.
-
- Sep 24, 2021
-
-
Vinoth Kannan authored
Recent commit 9d836281 is not compatible with old versions of Discourse.
-
- Sep 22, 2021
-
-
Roman Rizzi authored
We started seeing [this error](https://github.com/onelogin/ruby-saml/issues/577) on some of our sites, which has been fixed on 1.12.1.
-
- Jul 27, 2021
-
-
Vinoth Kannan authored
-
- Jul 23, 2021
-
-
Vinoth Kannan authored
Now we can sync or create user fields based on the new `saml_user_field_statements` environment variable's mapping.
-
- Mar 25, 2021
-
-
David Taylor authored
These were removed from core in https://github.com/discourse/discourse/commit/d2bceff133ac152678a1407d45fea260a0fe8536
-
- Nov 12, 2020
-
-
Vinoth Kannan authored
-
- Jun 05, 2020
-
-
p-betula authored
-
- Apr 29, 2020
-
-
Bernhard Suttner authored
In case the user isn't assigned to any (non-automatic) group, the user wasn't added.
-
- Apr 23, 2020
-
-
Robin Ward authored
This makes sure the saml_request can only insert strings into the HTML form.
-
Robin Ward authored
-