33058b5f3f
This PR adds the foundation for account-level SAML SSO configuration in Chatwoot Enterprise. It introduces a new `AccountSamlSettings` model and management API that allows accounts to configure their own SAML identity providers independently, this also includes the certificate generation flow The implementation includes a new controller (`Api::V1::Accounts::SamlSettingsController`) that provides CRUD operations for SAML configuration The feature is properly gated behind the 'saml' feature flag and includes administrator-only authorization via Pundit policies.
60 lines
1.5 KiB
Ruby
60 lines
1.5 KiB
Ruby
# == Schema Information
|
|
#
|
|
# Table name: account_saml_settings
|
|
#
|
|
# id :bigint not null, primary key
|
|
# certificate :text
|
|
# role_mappings :json
|
|
# sso_url :string
|
|
# created_at :datetime not null
|
|
# updated_at :datetime not null
|
|
# account_id :bigint not null
|
|
# idp_entity_id :string
|
|
# sp_entity_id :string
|
|
#
|
|
# Indexes
|
|
#
|
|
# index_account_saml_settings_on_account_id (account_id)
|
|
#
|
|
class AccountSamlSettings < ApplicationRecord
|
|
belongs_to :account
|
|
|
|
validates :account_id, presence: true
|
|
validates :sso_url, presence: true
|
|
validates :certificate, presence: true
|
|
validates :idp_entity_id, presence: true
|
|
|
|
before_validation :set_sp_entity_id, if: :sp_entity_id_needs_generation?
|
|
|
|
def saml_enabled?
|
|
sso_url.present? && certificate.present?
|
|
end
|
|
|
|
def certificate_fingerprint
|
|
return nil if certificate.blank?
|
|
|
|
begin
|
|
cert = OpenSSL::X509::Certificate.new(certificate)
|
|
OpenSSL::Digest::SHA1.new(cert.to_der).hexdigest
|
|
.upcase.gsub(/(.{2})(?=.)/, '\1:')
|
|
rescue OpenSSL::X509::CertificateError
|
|
nil
|
|
end
|
|
end
|
|
|
|
private
|
|
|
|
def set_sp_entity_id
|
|
base_url = GlobalConfigService.load('FRONTEND_URL', 'http://localhost:3000')
|
|
self.sp_entity_id = "#{base_url}/saml/sp/#{account_id}"
|
|
end
|
|
|
|
def sp_entity_id_needs_generation?
|
|
sp_entity_id.blank?
|
|
end
|
|
|
|
def installation_name
|
|
GlobalConfigService.load('INSTALLATION_NAME', 'Chatwoot')
|
|
end
|
|
end
|