fix(saml): drop-in parity for provider name, ACS URL, NameID format

The legacy Ruby service registered SAML as the OmniAuth strategy 'adfs'
(generic_adfs). That name is baked into external IdP registrations, the
/auth/adfs kickoff+callback paths, the login-event payload, and the
UserAuthLookup id (auth-<authority>-adfs-<uid>). auth.cr used 'saml',
which would 404 the /auth/adfs callback and \u2014 worse \u2014 fail to resolve
every existing SAML-linked account (recreating users instead).

It also advertised its own computed callback as the SAML ACS URL rather
than the DB-configured assertion_consumer_service_url the IdP has
registered, and never sent the strat's name_identifier_format.

- Register the SAML factory under 'adfs' (primary) with 'saml' kept as
  an internal alias; the recorded provider name is always 'adfs'.
- Advertise strat.assertion_consumer_service_url (DB) as the ACS URL.
- Pass strat.name_identifier_format through to the AuthnRequest.

Makes SAML SSO a true drop-in: no IdP re-registration, no orphaned
UserAuthLookup rows. Adds SAMLRequest-decoding specs asserting the ACS
URL + issuer come from the DB and that /auth/adfs is served.

Author: chillfox

spec/controllers/saml_callbacks_spec.cr

@@ -1,3 +1,6 @@
+require "base64"
+require "compress/deflate"
+
 require "../helper"
 
 module PlaceOS::Auth
@@ -23,6 +26,63 @@ module PlaceOS::Auth
       strat
     }
 
+    # The legacy Ruby service registered SAML as the OmniAuth strategy
+    # "adfs" (generic_adfs), so external IdP registrations, the
+    # `/auth/adfs` kickoff/callback paths, and the `UserAuthLookup` id
+    # (`auth-<authority>-adfs-<uid>`) all use "adfs". It also advertised
+    # the DB-configured `assertion_consumer_service_url` as the ACS URL.
+    # For a drop-in, auth.cr must reproduce all of that exactly.
+    describe "SAML drop-in parity", tags: "saml-parity" do
+      # A strat whose ACS URL is deliberately NOT what auth.cr would
+      # compute from the request host, so we can prove it comes from the
+      # DB column and not from `callback_uri`.
+      create_adfs_strat = -> {
+        authority = ::PlaceOS::Model::Authority.find_by_domain("localhost").not_nil!
+        strat = ::PlaceOS::Model::SamlAuthentication.new
+        strat.name = "test-adfs-#{Random.rand(99999)}"
+        strat.issuer = "https://sp.example.test/metadata-#{Random.rand(99999)}"
+        strat.idp_sso_target_url = "https://idp.example.test/sso"
+        strat.assertion_consumer_service_url = "https://prod.example.com/auth/adfs/callback?id=preconfigured"
+        strat.name_identifier_format = "urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"
+        strat.uid_attribute = "email"
+        strat.authority_id = authority.id
+        strat.save!
+        strat
+      }
+
+      decode_saml_request = ->(location : String) {
+        query = location.split('?', 2).last
+        raw = URI::Params.parse(query)["SAMLRequest"]
+        deflated = Base64.decode(raw)
+        Compress::Deflate::Reader.open(IO::Memory.new(deflated), &.gets_to_end)
+      }
+
+      it "serves the SAML kickoff at /auth/adfs (legacy provider name)" do
+        strat = create_adfs_strat.call
+        result = client.get(
+          "/auth/adfs?id=#{URI.encode_www_form(strat.id.as(String))}",
+          headers: HTTP::Headers{"Host" => "localhost"},
+        )
+        result.status_code.should eq 303
+        result.headers["Location"].should start_with "https://idp.example.test/sso"
+      ensure
+        strat.try &.destroy
+      end
+
+      it "advertises the DB assertion_consumer_service_url as the ACS URL" do
+        strat = create_adfs_strat.call
+        result = client.get(
+          "/auth/adfs?id=#{URI.encode_www_form(strat.id.as(String))}",
+          headers: HTTP::Headers{"Host" => "localhost"},
+        )
+        xml = decode_saml_request.call(result.headers["Location"])
+        xml.should contain %(AssertionConsumerServiceURL="#{strat.assertion_consumer_service_url}")
+        xml.should contain strat.issuer
+      ensure
+        strat.try &.destroy
+      end
+    end
+
     describe "GET /auth/saml (kickoff)" do
       it "redirects to the IdP's SSO URL with a SAMLRequest" do
         strat = create_saml_strat.call

src/placeos-auth/external_providers.cr

@@ -15,12 +15,16 @@ module PlaceOS::Auth::ExternalProviders
   # `:generic_oauth` strategy from the Ruby service.
   OAUTH2_PROVIDER = "oauth2"
 
-  # SAML callbacks come in as `/auth/saml/callback?id=<adfs_strat.id>`.
-  # Replaces the OmniAuth `:generic_adfs` strategy from the Ruby
-  # service. We keep the `saml` name (not `adfs`) because that's the
-  # protocol and the original `:generic_adfs` was just an AD-FS-
-  # specific wrapper around the same SAML 2.0 dance.
-  SAML_PROVIDER = "saml"
+  # SAML callbacks. The legacy Ruby service registered its SAML strategy
+  # under the OmniAuth name `adfs` (`generic_adfs`), so that name is
+  # baked into external IdP registrations, the `/auth/adfs` kickoff and
+  # callback paths, the login-event payload, and — critically — the
+  # `UserAuthLookup` id (`auth-<authority>-adfs-<uid>`). We must reuse it
+  # verbatim, or existing SAML-linked accounts won't resolve after the
+  # swap. `saml` is kept as an internal alias (auth.cr-era callers), but
+  # the recorded provider name is always `adfs`.
+  SAML_PROVIDER       = "adfs"
+  SAML_PROVIDER_ALIAS = "saml"
 
   def self.register!
     ::MultiAuth.config(OAUTH2_PROVIDER) do |redirect_uri, provider_id|
@@ -30,6 +34,10 @@ module PlaceOS::Auth::ExternalProviders
     ::MultiAuth.config(SAML_PROVIDER) do |redirect_uri, provider_id|
       build_saml(redirect_uri, provider_id)
     end
+
+    ::MultiAuth.config(SAML_PROVIDER_ALIAS) do |redirect_uri, provider_id|
+      build_saml(redirect_uri, provider_id)
+    end
   end
 
   # ---- OAuth2 -------------------------------------------------------
@@ -73,13 +81,22 @@ module PlaceOS::Auth::ExternalProviders
       raise ::MultiAuth::Exception.new("unknown saml strategy: #{provider_id.inspect}")
     end
 
+    # Advertise the DB-configured ACS URL — exactly what the IdP has
+    # registered and what the legacy service sent
+    # (`options.assertion_consumer_service_url = strat.assertion_consumer_service_url`).
+    # `multi_auth_saml` uses `redirect_uri` as the ACS URL, so pass the
+    # DB value straight through (falling back to the computed callback
+    # only if the column is somehow blank).
+    acs_url = strat.assertion_consumer_service_url.presence || redirect_uri
+
     ::MultiAuth::Provider::SAML.new(
       provider_name: SAML_PROVIDER,
-      redirect_uri: redirect_uri,
+      redirect_uri: acs_url,
       idp_sso_url: strat.idp_sso_target_url,
       idp_cert: strat.idp_cert,
       idp_cert_fingerprint: strat.idp_cert_fingerprint,
       sp_entity_id: strat.issuer,
+      name_identifier_format: strat.name_identifier_format,
       uid_attribute: strat.uid_attribute,
       attribute_statements: saml_attribute_mapping(strat),
       want_assertions_signed: strat.idp_cert.presence || strat.idp_cert_fingerprint.presence ? true : false,