diff --git a/app/controllers/devise_overrides/omniauth_callbacks_controller.rb b/app/controllers/devise_overrides/omniauth_callbacks_controller.rb index fac42cfe4..62a19d220 100644 --- a/app/controllers/devise_overrides/omniauth_callbacks_controller.rb +++ b/app/controllers/devise_overrides/omniauth_callbacks_controller.rb @@ -37,8 +37,13 @@ class DeviseOverrides::OmniauthCallbacksController < DeviseTokenAuth::OmniauthCa private def handle_saml_auth - account_id = extract_saml_account_id + # Check if enterprise edition and SAML feature are available + return redirect_to login_page_url(error: 'saml-not-available'), allow_other_host: true unless ChatwootApp.enterprise? + account_id = extract_saml_account_id + account = Account.find_by(id: account_id) if account_id + + return redirect_to login_page_url(error: 'saml-not-enabled'), allow_other_host: true if account && !account.feature_enabled?('saml') return redirect_to login_page_url(error: 'saml-not-enabled'), allow_other_host: true if account_id && !saml_enabled_for_account?(account_id) @resource = SamlUserBuilder.new(auth_hash, account_id: account_id).perform @@ -60,6 +65,8 @@ class DeviseOverrides::OmniauthCallbacksController < DeviseTokenAuth::OmniauthCa end def saml_enabled_for_account?(account_id) + return false unless ChatwootApp.enterprise? + AccountSamlSettings.find_by(account_id: account_id, enabled: true).present? end diff --git a/config/locales/en.yml b/config/locales/en.yml index 54ad7d260..840bce300 100644 --- a/config/locales/en.yml +++ b/config/locales/en.yml @@ -41,6 +41,7 @@ en: reset_password_failure: Uh ho! We could not find any user with the specified email. reset_password_saml_user: This account uses SAML authentication. Password reset is not available. Please contact your administrator. login_saml_user: This account uses SAML authentication. Please sign in through your organization's SAML provider. + saml_not_available: SAML authentication is not available in this installation. inbox_deletetion_response: Your inbox deletion request will be processed in some time. errors: