Problem configuring SAML auth

Support
1

Hello everybody,

Preamble

My version of CodiMD is: 1.5.0

To be sure it’s not some build related issue, I rebuilt it today (last build of the image was 2 months ago); to build I use docker-compose, this is the relevant yml part:

    build:
      context: ./dockerfiles/codimd
      dockerfile: codimd-alpine
      args:
        - "VERSION=master"
        - "CODIMD_REPOSITORY=https://github.com/codimd/server.git"
    image: codimd-alpine:master

the dockerfile is local but is the official one.

What I expected to happen

I expect to download the SAML metadata XML as pointed in Authentication guide - SAML:

If your IdP accepts metadata XML of the service provider to ease configuration, use this url to download metadata XML.

{{your-serverurl}}/auth/saml/metadata

Note: If not accessible from IdP, download to local once and upload to IdP.

The url I use is https://pad.mydomain.com/auth/saml/metadata (CodiMD works fine on that domain)

What actually happened

I get a 404 Not Found error, this happens if I am logged in as registered user (user registration is disabled)

If I’m not logged in, I get the message:

You are not allowed to access this page. Maybe try logging in?

I already tried

I asked for help on our Matrix room and with the help of @foobarable and @Sheogorath I tried to enable SAML support defining this two env variables:

CMD_SAML_ISSUER=https://pad.narratron.io/saml
CMD_SAML_GROUPATTRIBUTE=memberOf

but still it gives me 404 or please authenticate

I do not understand how to enable the SAML code, the first thing I need is the XML config file from my instance.

Any hint please

Thanks! Giovanni

2

I solved by adding this to the config.json in my
container/resources folder used by my dockerfile

	"saml": {
	    "idpSsoUrl": "ommitted",
	    "idpCert": "/codimd/node_modules/passport-saml/test/static/cert.pem"
	}

AFAIU both idpCert and idpSsoUrl are required to activate passport and thus to make sure SAML routes are working fine.

I have not tried to define CMD_SAML_IDPCERT and CMD_SAML_IDPSSOURL env variables instead of adding the json SAML section above: that could be a better alternative (to be documented) to my solution.

WDYT?

Thanks! Gio’