feat: import SAML IdP configuration from a metadata URL

Merged
RI
2mo ago
+973-2

Proposed changes (including videos or screenshots)

Setting up SAML today means pasting the IdP signing certificate (PEM) into the admin UI by hand — error‑prone and a common source of misconfiguration (raised by customer MIE after a 7.x → 8.5.1 upgrade).

This adds an "Import IdP metadata" button to the SAML settings header (like the LDAP page). The admin pastes the IdP metadata URL, the server fetches and parses it, and the extracted values are shown in an editable preview. On Apply they are prefilled into the settings form for review before Save — nothing is persisted automatically.

Auto‑filled from the IdP EntityDescriptor:

MetadataSetting
KeyDescriptor use="signing" → X509CertificateCustom Certificate
SingleSignOnService (HTTP‑Redirect) → LocationCustom Entry Point
SingleLogoutService → LocationIDP SLO Redirect URL
NameIDFormatIdentifier Format (Enterprise)

Service‑Provider settings (Issuer, Provider, keys, signature options, mappings) are never touched — they describe Rocket.Chat, not the IdP.

Implementation
  • Endpoint POST /v1/saml.parseMetadata (test-admin-options) — returns parsed values, never writes settings. Fetch via @rocket.chat/server-fetch with SSRF validation on (SSRF_Allowlist), a timeout and a size cap.
  • Parser server/lib/saml/lib/parsers/IdpMetadata.ts — parses EntityDescriptor, validates the cert as X.509 (SAMLUtils.isValidCertificate) and SSO/SLO Locations as http(s).
  • UI — SAMLGroupPage (header button, mirrors LDAPGroupPage) + SamlMetadataModal (a GenericModal form: fetch → editable preview → apply). The Identifier Format row appears only when that Enterprise setting is registered.

Issue(s)

Steps to test or reproduce

  1. Start a test IdP (details below): docker compose -f docker-compose.saml-test.yml up -d
  2. Admin → General → SSRF Protection → add 127.0.0.1:8080 to SSRF Allowlist → Save. (use the IP; localhost can't be allowlisted)
  3. Admin → SAML → enable → Import IdP metadata → paste http://127.0.0.1:8080/simplesaml/saml2/idp/metadata.php → Fetch → Apply → Save.
docker-compose.saml-test.yml 
services:
  saml-idp:
    image: kristophjunge/test-saml-idp
    ports: ["8080:8080", "8443:8443"]
    environment:
      SIMPLESAMLPHP_SP_ENTITY_ID: http://localhost:3000/_saml/metadata/test-sp
      SIMPLESAMLPHP_SP_ASSERTION_CONSUMER_SERVICE: http://localhost:3000/_saml/validate/test-sp
      SIMPLESAMLPHP_SP_SINGLE_LOGOUT_SERVICE: http://localhost:3000/_saml/logout/test-sp

Metadata URL: http://127.0.0.1:8080/simplesaml/saml2/idp/metadata.php

Full SAML login + edge cases

End‑to‑end login: set Custom Provider = test-sp, Custom Issuer = http://localhost:3000/_saml/metadata/test-sp, User Data Mapping {"username":"uid","email":"email","name":"uid"} → Save → log in via the SAML button with user1 / user1pass.

Edge cases:

  • No SingleLogoutService → SLO left blank, no error.
  • Multiple signing certs (e.g. Azure AD .../federationmetadata/2007-06/federationmetadata.xml) → first used + warning.
  • HTML / non‑metadata → "not valid SAML IdP metadata".
  • Private / non‑allowlisted host → SSRF‑blocked error pointing to the allowlist.

Further comments

Summary by CodeRabbit

  • New Features
    • Added an “Import metadata” option to SAML settings.
    • Administrators can enter an Identity Provider metadata URL and review prefilled certificate, entry point, SLO redirect URL, and identifier format values before saving.
  • Security
    • Added protections against unsafe metadata URLs and restricted access to authorized administrators.
  • Bug Fixes
    • Added validation feedback, warnings, retry support, and handling for invalid, inaccessible, or oversized metadata.
  • Documentation
    • Added guidance to review imported values before saving.