feat(auth): add native SAML 2.0 SSO integration

Browse Source

Add SAML 2.0 as a second SSO protocol alongside OIDC under a unified
authMode/ssoType model. SP flows via @node-saml/node-saml: AuthnRequest
generation, ACS POST assertion handling, SP metadata export, and admin
config test endpoint. Replay-protected via saml_state cookie (httpOnly,
SameSite=Lax) matched against InResponseTo; wantAssertionsSigned enforced.

- src/lib/auth/saml.js: SAML instance builder, X.509 cert formatter, claim pickers
- 4 routes under src/app/api/auth/saml/: start, acs, metadata, test
- settingsRepo: ssoType + saml* defaults; login/status routes dispatch by type
- profile page: SSO protocol switcher, IdP metadata XML + cert uploaders
- login page: dynamic SAML sign-in button; Header: SAML user badge

...

This commit is contained in:

Duc Nguyen

2026-08-13 17:53:17 +07:00

committed by decolua

parent e02bde4a70

commit 65197ad11c

17 changed files with 1396 additions and 166 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download Patch File Download Diff File Expand all files Collapse all files

BIN

docs/images/saml-admin-dashboard.png Normal file

Binary file not shown.

Side by Side After Width:  |  Height:  |  Size: 103 KiB

BIN

docs/images/saml-login-screen.png Normal file

Binary file not shown.

Side by Side After Width:  |  Height:  |  Size: 15 KiB