chore!: require a Premium plan for LDAP and SAML

Merged
GG
6d ago
+1714-1676

Proposed changes

Second of two PRs turning LDAP and SAML into Premium-only features. The deprecation notice ships on 8.x in #41642; this one enforces it on 9.0.0 and moves the implementation under the Enterprise license.

Gate

SurfaceBehavior without the license module
LDAP_Enableenterprise: true, modules: ['ldap-enterprise'], invalidValue: false — reads as false, so the whole enableQuery cascade goes with it
SAML_Custom_<service>same, with saml-enterprise — no provider is loaded, so the login button disappears
LDAP login handlerreturns undefined
SAML login handlerreturns undefined
/_saml/*falls through to the next middleware
ldap.syncNow, ldap.testConnection, ldap.testSearch400 error-action-not-allowed

The settings flags alone are enough in practice; the runtime guards cover the window between a license being removed and the providers being reloaded, and any path that reads the setting from somewhere other than the cache.

Move

The implementation moved from apps/meteor/server to apps/meteor/ee/server, so it falls under apps/meteor/ee/LICENSE instead of the community one:

  • server/lib/saml/ → ee/server/lib/saml/
  • server/lib/ldap/ → ee/server/lib/ldap/ (the pre-existing EE Manager.ts became EEManager.ts to free the name for the core one)
  • server/api/v1/ldap.ts → ee/server/api/ldapCore.ts
  • server/services/ldap/service.ts → ee/server/local-services/ldap/coreService.ts
  • server/settings/ldap.ts → ee/server/settings/ldapCore.ts
  • server/configuration/ldap.ts → ee/server/configuration/ldapCore.ts
  • server/meteor-methods/auth/{samlLogout,addSamlService}.ts → ee/server/meteor-methods/

What stays in the community tree is only the import lines that register all of it — importPackages.ts, api/index.ts, configuration/index.ts, settings/definitions.ts, services/startup.ts, meteor-methods/index.ts. Registration order and license-independence of the settings are unchanged: the LDAP settings group is still registered on every workspace, it just reads as disabled and shows the Premium tag.

Tests

  • tests/e2e/saml.spec.ts skips on the CE matrix (the suite drives a real SAML login).
  • tests/end-to-end/api/LDAP.ts: the CE expectation on ldap.syncNow moves from totp-required to error-action-not-allowed, since the license middleware runs before the 2FA check. The permission tests are unaffected — the permission middleware runs first.
  • .mocharc.js globs follow the moved specs; ee/server/lib/ldap/** now covers operations/.
  • Unit specs that stub by module specifier (proxyquire) were updated to the new paths, and the SAML login handler spec stubs @rocket.chat/license.

ee/server/lib/ldap/** (89 tests) and tests/unit/server/lib/saml/** (82 tests) pass locally. tsc --noEmit adds no new errors.

Issue(s)

Enforces the deprecation announced in #41642.

Steps to test or reproduce

  1. Without a license: confirm the LDAP and SAML settings show the Premium tag and are read-only, that LDAP and SAML logins fail, that /_saml/metadata/<provider> no longer answers, and that ldap.syncNow returns error-action-not-allowed.
  2. With a license including both modules: confirm LDAP and SAML behave exactly as on 8.x, including background sync and the SAML e2e suite.
  3. Remove the license from a running workspace and confirm logins stop without a restart.

Further comments

Two things worth a decision before this leaves draft:

  • Admin lockout. A workspace whose only admin authenticates through LDAP or SAML loses all access on upgrade. Worth a migration that refuses to gate — or at least logs loudly — when no admin has a local password.
  • License plans. This only bites if ldap-enterprise and saml-enterprise are absent from the free/Starter bundle issued by the license server. That is configuration outside this repo and should be confirmed before release.

Summary by CodeRabbit

  • Important
    • Starting in version 9.0.0, LDAP and SAML authentication require a Premium plan with the corresponding module. Workspaces without a qualifying license will lose these sign-in options after upgrading. Keep a qualifying license or ensure administrators have another sign-in method.
  • Features
    • LDAP configuration and account synchronization are available with the LDAP enterprise module.
  • Bug Fixes
    • LDAP and SAML login-related requests are unavailable when their required license modules are not present.