Merge branch 'feat/saml-controllers' into feat/saml-ui

config/application.rb

@@ -47,11 +47,6 @@ module Chatwoot
     # Add enterprise views to the view paths
     config.paths['app/views'].unshift('enterprise/app/views')
 
-    # Load enterprise initializers after standard initializers
-    config.after_initialize do
-      Dir[Rails.root.join('enterprise/config/initializers/*.rb')].sort.each { |f| load f }
-    end
-
     # Settings in config/environments/* take precedence over those specified here.
     # Application configuration can go into files in config/initializers
     # -- all .rb files in that directory are automatically loaded after loading

config/initializers/omniauth.rb

@@ -1,9 +1,48 @@
-# OmniAuth configuration
-# Sets the full host URL for callbacks and proper redirect handling
+# Required for SAML SSO - ensures consistent callback URLs and SP entity ID across environments
+# SAML authentication is sensitive to URL mismatches, so OmniAuth needs the correct host
 OmniAuth.config.full_host = ENV.fetch('FRONTEND_URL', 'http://localhost:3000')
 
+# SAML setup proc for multi-tenant configuration
+SAML_SETUP_PROC = proc do |env|
+  request = ActionDispatch::Request.new(env)
+
+  # Extract account_id from various sources
+  account_id = request.params['account_id'] ||
+               request.session[:saml_account_id] ||
+               env['omniauth.params']&.dig('account_id')
+
+  if account_id
+    # Store in session and omniauth params for callback
+    request.session[:saml_account_id] = account_id
+    env['omniauth.params'] ||= {}
+    env['omniauth.params']['account_id'] = account_id
+
+    # Find SAML settings for this account
+    settings = AccountSamlSettings.find_by(account_id: account_id)
+
+    if settings
+      # Configure the strategy options dynamically
+      env['omniauth.strategy'].options[:assertion_consumer_service_url] = "#{ENV.fetch('FRONTEND_URL', 'http://localhost:3000')}/omniauth/saml/callback?account_id=#{account_id}"
+      env['omniauth.strategy'].options[:sp_entity_id] = settings.sp_entity_id
+      env['omniauth.strategy'].options[:idp_entity_id] = settings.idp_entity_id
+      env['omniauth.strategy'].options[:idp_sso_service_url] = settings.sso_url
+      env['omniauth.strategy'].options[:idp_cert] = settings.certificate
+      env['omniauth.strategy'].options[:name_identifier_format] = 'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress'
+    else
+      # Set a dummy certificate to avoid the error
+      env['omniauth.strategy'].options[:idp_cert] = 'DUMMY'
+    end
+  else
+    # Set a dummy certificate to avoid the error
+    env['omniauth.strategy'].options[:idp_cert] = 'DUMMY'
+  end
+end
+
 Rails.application.config.middleware.use OmniAuth::Builder do
   provider :google_oauth2, ENV.fetch('GOOGLE_OAUTH_CLIENT_ID', nil), ENV.fetch('GOOGLE_OAUTH_CLIENT_SECRET', nil), {
     provider_ignores_state: true
   }
+
+  # SAML provider with setup phase for multi-tenant configuration (Enterprise only)
+  provider :saml, setup: SAML_SETUP_PROC if defined?(ChatwootApp) && ChatwootApp.enterprise?
 end

enterprise/config/initializers/omniauth.rb

@@ -1,43 +0,0 @@
-# Enterprise Edition SAML SSO Provider
-# This initializer adds SAML authentication support for Enterprise customers
-
-# SAML setup proc for multi-tenant configuration
-SAML_SETUP_PROC = proc do |env|
-  request = ActionDispatch::Request.new(env)
-
-  # Extract account_id from various sources
-  account_id = request.params['account_id'] ||
-               request.session[:saml_account_id] ||
-               env['omniauth.params']&.dig('account_id')
-
-  if account_id
-    # Store in session and omniauth params for callback
-    request.session[:saml_account_id] = account_id
-    env['omniauth.params'] ||= {}
-    env['omniauth.params']['account_id'] = account_id
-
-    # Find SAML settings for this account
-    settings = AccountSamlSettings.find_by(account_id: account_id)
-
-    if settings
-      # Configure the strategy options dynamically
-      env['omniauth.strategy'].options[:assertion_consumer_service_url] = "#{ENV.fetch('FRONTEND_URL', 'http://localhost:3000')}/omniauth/saml/callback?account_id=#{account_id}"
-      env['omniauth.strategy'].options[:sp_entity_id] = settings.sp_entity_id
-      env['omniauth.strategy'].options[:idp_entity_id] = settings.idp_entity_id
-      env['omniauth.strategy'].options[:idp_sso_service_url] = settings.sso_url
-      env['omniauth.strategy'].options[:idp_cert] = settings.certificate
-      env['omniauth.strategy'].options[:name_identifier_format] = 'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress'
-    else
-      # Set a dummy certificate to avoid the error
-      env['omniauth.strategy'].options[:idp_cert] = 'DUMMY'
-    end
-  else
-    # Set a dummy certificate to avoid the error
-    env['omniauth.strategy'].options[:idp_cert] = 'DUMMY'
-  end
-end
-
-Rails.application.config.middleware.use OmniAuth::Builder do
-  # SAML provider with setup phase for multi-tenant configuration
-  provider :saml, setup: SAML_SETUP_PROC
-end