[bug] SAML Labelling with multiple groups or roles

MAHDTech commented 1 month ago

Is there an existing issue for this?

[X] I have searched the existing issues

Current Behavior

Hi, I am testing Omni v0.35.0 with my SAML Provider VMware Workspace ONE Access

I have been able to login using SAML and create ACLs for individual users which work great once the user is assigned a role manually.

I'm having an issue with the automatic SAML rules to assign users to an Omni role based on a SAML role or groups in the SAML assertion.

So far I have,

Configured the SAML Assertion to return groups and role (see gist below)
Created a SAMLLabelRules.omni.sidero.dev object (see gist below)
Logged in for the first time as my test user as the SAML rules apply only on first login as noted the docs. Between each test I delete the user from Omni.

The user is not being assigned any Omni role.

Any pointers where I've gone wrong here?

Expected Behavior

The user is assigned an Omni role based on their groups or role SAML Attribute.

Steps To Reproduce

Omni v0.35.0
VMware Workspace ONE Access

I have a gist with the captured logs and a snippet from the SAML assertion reply available here

https://gist.github.com/MAHDTech/10c1f673a0f9b26cb46760e1658b2510

What browsers are you seeing the problem on?

Chrome

Anything else?

There are a few things that might be worth calling out;

There are groups which has spaces in the names like ALL USERS which are built-in and can't be modified
This environment has quite a few groups that are in the SAML assertion (> 25 per user is common).
This can be an issue we've seen in the past where cookie sizes needed to be increased in Load Balancers for example to handle the increase in response size.

MAHDTech commented 1 month ago

One thing I forgot to mention was inside the Omni UI, on the settings page, I see a single label against my test user so it seems to be mapping only the first role thats listed inside the SAML assertion.

Unix4ever commented 1 month ago

Yeah. That looks like a new SAML variation that we don't handle correctly :upside_down_face:

It doesn't assign the role as it maps only the first role attribute from SAML.

Unix4ever commented 1 month ago

You'll also need to set Omni flag --auth-saml-label-rules='{"groups": "groups"}' to make Omni extract groups attribute. Here it means extract attribute with name groups into label saml.omni.sidero.dev/groups/<value>

MAHDTech commented 1 month ago

Thanks!

I can confirm v0.35.0-beta.0-3-g7bd922a that includes the PR works for both role and groups with Workspace ONE Access :+1:

siderolabs / omni