search

chrodriguez / redmine_omniauth_saml

Plugins that adds SAML authentication support for "Redmine"
GNU General Public License v2.0
38 stars 57 forks source link

Errors on 2.0 branch #26

Closed rcknr closed 7 years ago

rcknr commented 7 years ago

After installing the plugin I get an error on the callback action:

NameError (uninitialized constant User::RedmineSAML):
  plugins/redmine_omniauth_saml/lib/redmine_omniauth_saml/user_patch.rb:27:in `saml_attribute'

What can be done to make the plugin work?

rcknr commented 7 years ago

My bad. I actually didn't realize I had to copy to Redmine's config/initializers folder, not plugins'! So plugin appears to work but I still can't login. I get the following message upon successful login with my identity provider: Invalid user or password. You may want to close SSO session before trying an other username. My provider user email as login. Here's an exerpt from SAML response:

<saml2:Attribute Name="login">
  <saml2:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:anyType">user@domain.com</saml2:AttributeValue>
</saml2:Attribute>

I've noticed that user_patch.rb uses find_by_login method to get the user, which won't work in my case. Is it possible to change something to be able to log in?

chrodriguez commented 7 years ago

Hi, there is a plugin option that allows you yo create users not found on redmine... hopes ir helps

rcknr commented 7 years ago

Thanks! I've figured out this is a configuration issue mostly. I was assuming however from the configuration provided that the user is selected by e-mail address. So I've changed it accordingly to user.find_by_mail call and it works great now. I'd like to write configuration tutorial for Redmine 2.x and G Suite SSO provider for others to use.

chrodriguez commented 7 years ago

Nice!!! Thanks in advance

rcknr commented 7 years ago

Would you consider changing user selection to by email? For new installations it's no problem but existing ones might use something else as login (like it was in my case). Could by done as a toggleble setting to avoid compatibility problems. I'd do a PR if that's okay.