And add a option to add multiple certificates in site setting with "|" separator.

This commit already added in a brach and deployed to a client before. https://github.com/discourse/discourse-saml/commit/ddeb2615529eb0f9cac9621e247feebf31e65fee

In production, the SAML omniauth strategy returns some very complex data structures in the `extra` data. These have circular references, and can cause a "stack level too deep" error when serializing to JSON. This commit simplifies thing so we only try to store the attributes hash.

All data will be automatically migrated from `oauth2_user_infos` to the `user_associated_accounts` table

There is only one SAMLAuthenticator instance per-process. Storing user-specific state in it is risky (although, in our default unicorn-based config, is unlikely to cause issues because we only handle one concurrent request per process).

This commit also updates our implementation to use the built-in `#single` and `#multi` methods provided by the SAML gem. This avoids the need for our custom `&.first`, `&.split` and `&.join` implementation.

Starting from https://github.com/discourse/discourse/commit/c2022521906b3c44a8a21e8eb2527c8650e06a18 we can pass to `UsernameSuggester` an array of inputs parameters and it'll be skipping invalid items and trying next ones.

Some variable renames were missed, and some specs are no longer relevant

Core takes care of suggesting usernames during normal signup. Suggesting them here as well can cause unexpected issues (e.g. when staged users sign up).

The SAML plugin currently has a bespoke `auto_create_account` implementation, which **does** need to do its own username suggestion. Therefore this commit moves all the suggestion logic into `auto_create_account`.

An integration spec for staged-user signup is also introduced.

Regression introduced in e9f9150b

GlobalSettings configured via environment variables will continue to take precendence, so this change is backwards compatible.

- `.presence` is added to string values, since 'unset' site settings are never `nil`
- saml_force_domains is split on `|` and `,` because site settings expect a `|`, while the old global setting expected a `,`
- Specs are migrated to use SiteSettings, because GlobalSettings do not override SiteSettings in test mode

The prefix is added by the helper. Adding it here causes it to be prefixed twice.

This centralises our logic for accessing settings. This particular commit should be a no-op. I intend to followup with the new site setting definitions in a future commit.

Putting this logic into the omniauth strategy is much cleaner because:
- we no longer need a Rails controller and the associated `custom_url` parameter
- we can re-use the `authn_request` instance which is automatically generated by the omniauth strategy, rather than re-implementing that logic
- the behavior is decided at runtime, rather than during initialization. This makes it testable, and is another step on the way to making the plugin multisite-compatible

This commit also introduces a spec for the feature.

This will allow much easier testing of the strategy, and is one more step towards making the SAML plugin multisite-compatible

For `name`, the previous intention was to use the `fullName` attribute, and then fallback to "firstname lastname". However, a bug in the implementation meant that the `fullName` was skipped.

This commit updates the logic to lean on omniauth-saml's attribute_statements for the fullName, firstName and lastName attributes, and also updates the priority logic so that fullName is indeed prioritized.

Co-authored-by: Bastien Le Querrec <blq@laquadrature.net>

If your IDP transmits `cn=groupname,cn=groups,dc=example,dc=com` you can set this to true to use only `groupname`. This is useful if you want to keep the standard group name length of Discourse (20 characters).

Co-authored-by: Andreas Teuber <andreas.teuber@passiv.de>

Now we can sync or create user fields based on the new `saml_user_field_statements` environment variable's mapping.

In case the user isn't assigned to any (non-automatic) group, the user
wasn't added.

* Support for GlobalSetting.saml_base_url

* Push file with class method...

Co-authored-by: Richard <richard@discoursehosting.com>

* RFC: groups full sync

* Update lib/saml_authenticator.rb

Co-Authored-By: Robin Ward <robin.ward@gmail.com>

* Update lib/saml_authenticator.rb

Co-Authored-By: Robin Ward <robin.ward@gmail.com>

* Update README.md

Co-Authored-By: Robin Ward <robin.ward@gmail.com>