From f6fe1b130b117132569c8f1f3942e7fece2ee2e2 Mon Sep 17 00:00:00 2001 From: Shivam Mishra Date: Thu, 28 Aug 2025 14:34:18 +0530 Subject: [PATCH] feat: don't allow password login for SAML user --- .../devise_overrides/sessions_controller.rb | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/app/controllers/devise_overrides/sessions_controller.rb b/app/controllers/devise_overrides/sessions_controller.rb index fc7b12767..b81688c1b 100644 --- a/app/controllers/devise_overrides/sessions_controller.rb +++ b/app/controllers/devise_overrides/sessions_controller.rb @@ -3,6 +3,7 @@ class DeviseOverrides::SessionsController < DeviseTokenAuth::SessionsController # Unpermitted parameter: session wrap_parameters format: [] before_action :process_sso_auth_token, only: [:create] + before_action :check_saml_user, only: [:create] def new redirect_to login_page_url(error: 'access-denied') @@ -46,6 +47,24 @@ class DeviseOverrides::SessionsController < DeviseTokenAuth::SessionsController user = User.from_email(params[:email]) @resource = user if user&.valid_sso_auth_token?(params[:sso_auth_token]) end + + def check_saml_user + # Skip if using SSO token (SAML users can use SSO tokens) + return if params[:sso_auth_token].present? + return if params[:email].blank? + + user = User.from_email(params[:email]) + return unless user&.saml_user? + + render_saml_user_error + end + + def render_saml_user_error + render json: { + success: false, + errors: [I18n.t('messages.login_saml_user')] + }, status: :unauthorized + end end DeviseOverrides::SessionsController.prepend_mod_with('DeviseOverrides::SessionsController')