From f1f2b3f302067561bbbda7676683ed09078defc6 Mon Sep 17 00:00:00 2001 From: Shivam Mishra Date: Wed, 10 Sep 2025 10:55:00 +0530 Subject: [PATCH 1/2] Revert "feat: move saml init to enterprise" This reverts commit e0a5a63f2e73d16c4a3374c11d571eb621670988. --- config/application.rb | 5 --- config/initializers/omniauth.rb | 43 +++++++++++++++++++++- enterprise/config/initializers/omniauth.rb | 43 ---------------------- 3 files changed, 41 insertions(+), 50 deletions(-) delete mode 100644 enterprise/config/initializers/omniauth.rb diff --git a/config/application.rb b/config/application.rb index 7ea14a7b6..3eca267f0 100644 --- a/config/application.rb +++ b/config/application.rb @@ -47,11 +47,6 @@ module Chatwoot # Add enterprise views to the view paths config.paths['app/views'].unshift('enterprise/app/views') - # Load enterprise initializers after standard initializers - config.after_initialize do - Dir[Rails.root.join('enterprise/config/initializers/*.rb')].sort.each { |f| load f } - end - # Settings in config/environments/* take precedence over those specified here. # Application configuration can go into files in config/initializers # -- all .rb files in that directory are automatically loaded after loading diff --git a/config/initializers/omniauth.rb b/config/initializers/omniauth.rb index 54aa6ded8..397285438 100644 --- a/config/initializers/omniauth.rb +++ b/config/initializers/omniauth.rb @@ -1,9 +1,48 @@ -# OmniAuth configuration -# Sets the full host URL for callbacks and proper redirect handling +# Required for SAML SSO - ensures consistent callback URLs and SP entity ID across environments +# SAML authentication is sensitive to URL mismatches, so OmniAuth needs the correct host OmniAuth.config.full_host = ENV.fetch('FRONTEND_URL', 'http://localhost:3000') +# SAML setup proc for multi-tenant configuration +SAML_SETUP_PROC = proc do |env| + request = ActionDispatch::Request.new(env) + + # Extract account_id from various sources + account_id = request.params['account_id'] || + request.session[:saml_account_id] || + env['omniauth.params']&.dig('account_id') + + if account_id + # Store in session and omniauth params for callback + request.session[:saml_account_id] = account_id + env['omniauth.params'] ||= {} + env['omniauth.params']['account_id'] = account_id + + # Find SAML settings for this account + settings = AccountSamlSettings.find_by(account_id: account_id) + + if settings + # Configure the strategy options dynamically + env['omniauth.strategy'].options[:assertion_consumer_service_url] = "#{ENV.fetch('FRONTEND_URL', 'http://localhost:3000')}/omniauth/saml/callback?account_id=#{account_id}" + env['omniauth.strategy'].options[:sp_entity_id] = settings.sp_entity_id + env['omniauth.strategy'].options[:idp_entity_id] = settings.idp_entity_id + env['omniauth.strategy'].options[:idp_sso_service_url] = settings.sso_url + env['omniauth.strategy'].options[:idp_cert] = settings.certificate + env['omniauth.strategy'].options[:name_identifier_format] = 'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress' + else + # Set a dummy certificate to avoid the error + env['omniauth.strategy'].options[:idp_cert] = 'DUMMY' + end + else + # Set a dummy certificate to avoid the error + env['omniauth.strategy'].options[:idp_cert] = 'DUMMY' + end +end + Rails.application.config.middleware.use OmniAuth::Builder do provider :google_oauth2, ENV.fetch('GOOGLE_OAUTH_CLIENT_ID', nil), ENV.fetch('GOOGLE_OAUTH_CLIENT_SECRET', nil), { provider_ignores_state: true } + + # SAML provider with setup phase for multi-tenant configuration + provider :saml, setup: SAML_SETUP_PROC end diff --git a/enterprise/config/initializers/omniauth.rb b/enterprise/config/initializers/omniauth.rb deleted file mode 100644 index f73e3a109..000000000 --- a/enterprise/config/initializers/omniauth.rb +++ /dev/null @@ -1,43 +0,0 @@ -# Enterprise Edition SAML SSO Provider -# This initializer adds SAML authentication support for Enterprise customers - -# SAML setup proc for multi-tenant configuration -SAML_SETUP_PROC = proc do |env| - request = ActionDispatch::Request.new(env) - - # Extract account_id from various sources - account_id = request.params['account_id'] || - request.session[:saml_account_id] || - env['omniauth.params']&.dig('account_id') - - if account_id - # Store in session and omniauth params for callback - request.session[:saml_account_id] = account_id - env['omniauth.params'] ||= {} - env['omniauth.params']['account_id'] = account_id - - # Find SAML settings for this account - settings = AccountSamlSettings.find_by(account_id: account_id) - - if settings - # Configure the strategy options dynamically - env['omniauth.strategy'].options[:assertion_consumer_service_url] = "#{ENV.fetch('FRONTEND_URL', 'http://localhost:3000')}/omniauth/saml/callback?account_id=#{account_id}" - env['omniauth.strategy'].options[:sp_entity_id] = settings.sp_entity_id - env['omniauth.strategy'].options[:idp_entity_id] = settings.idp_entity_id - env['omniauth.strategy'].options[:idp_sso_service_url] = settings.sso_url - env['omniauth.strategy'].options[:idp_cert] = settings.certificate - env['omniauth.strategy'].options[:name_identifier_format] = 'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress' - else - # Set a dummy certificate to avoid the error - env['omniauth.strategy'].options[:idp_cert] = 'DUMMY' - end - else - # Set a dummy certificate to avoid the error - env['omniauth.strategy'].options[:idp_cert] = 'DUMMY' - end -end - -Rails.application.config.middleware.use OmniAuth::Builder do - # SAML provider with setup phase for multi-tenant configuration - provider :saml, setup: SAML_SETUP_PROC -end From 7a9840717ea05db118c2eecae63a522ea710bfc7 Mon Sep 17 00:00:00 2001 From: Shivam Mishra Date: Wed, 10 Sep 2025 10:56:06 +0530 Subject: [PATCH 2/2] feat: conditionally load saml --- config/initializers/omniauth.rb | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/config/initializers/omniauth.rb b/config/initializers/omniauth.rb index 397285438..04515d5d9 100644 --- a/config/initializers/omniauth.rb +++ b/config/initializers/omniauth.rb @@ -43,6 +43,6 @@ Rails.application.config.middleware.use OmniAuth::Builder do provider_ignores_state: true } - # SAML provider with setup phase for multi-tenant configuration - provider :saml, setup: SAML_SETUP_PROC + # SAML provider with setup phase for multi-tenant configuration (Enterprise only) + provider :saml, setup: SAML_SETUP_PROC if defined?(ChatwootApp) && ChatwootApp.enterprise? end