mirror of https://github.com/docusealco/docuseal
Adam Hesch
3 months ago
parent
5f04a2d098
commit
f2f1745526
@ -0,0 +1,91 @@
|
||||
FROM ruby:3.4.2-alpine AS download
|
||||
|
||||
WORKDIR /fonts
|
||||
|
||||
RUN apk --no-cache add fontforge wget && \
|
||||
wget https://github.com/satbyy/go-noto-universal/releases/download/v7.0/GoNotoKurrent-Regular.ttf && \
|
||||
wget https://github.com/satbyy/go-noto-universal/releases/download/v7.0/GoNotoKurrent-Bold.ttf && \
|
||||
wget https://github.com/impallari/DancingScript/raw/master/fonts/DancingScript-Regular.otf && \
|
||||
wget https://cdn.jsdelivr.net/gh/notofonts/notofonts.github.io/fonts/NotoSansSymbols2/hinted/ttf/NotoSansSymbols2-Regular.ttf && \
|
||||
wget https://github.com/Maxattax97/gnu-freefont/raw/master/ttf/FreeSans.ttf && \
|
||||
wget https://github.com/impallari/DancingScript/raw/master/OFL.txt && \
|
||||
wget -O pdfium-linux.tgz "https://github.com/docusealco/pdfium-binaries/releases/latest/download/pdfium-linux-$(uname -m | sed 's/x86_64/x64/;s/aarch64/arm64/').tgz" && \
|
||||
mkdir -p /pdfium-linux && \
|
||||
tar -xzf pdfium-linux.tgz -C /pdfium-linux
|
||||
|
||||
RUN fontforge -lang=py -c 'font1 = fontforge.open("FreeSans.ttf"); font2 = fontforge.open("NotoSansSymbols2-Regular.ttf"); font1.mergeFonts(font2); font1.generate("FreeSans.ttf")'
|
||||
|
||||
FROM ruby:3.4.2-alpine AS app
|
||||
|
||||
# Development environment settings
|
||||
ENV RAILS_ENV=development
|
||||
ENV NODE_ENV=development
|
||||
ENV BUNDLE_WITHOUT=""
|
||||
ENV LD_PRELOAD=/lib/libgcompat.so.0
|
||||
ENV OPENSSL_CONF=/app/openssl_legacy.cnf
|
||||
|
||||
WORKDIR /app
|
||||
|
||||
# Install system dependencies including nodejs and yarn for development
|
||||
RUN echo '@edge https://dl-cdn.alpinelinux.org/alpine/edge/community' >> /etc/apk/repositories && \
|
||||
apk add --no-cache \
|
||||
sqlite-dev \
|
||||
libpq-dev \
|
||||
mariadb-dev \
|
||||
vips-dev@edge \
|
||||
redis \
|
||||
libheif@edge \
|
||||
vips-heif@edge \
|
||||
gcompat \
|
||||
ttf-freefont \
|
||||
nodejs \
|
||||
yarn \
|
||||
git \
|
||||
build-base && \
|
||||
mkdir /fonts && \
|
||||
rm /usr/share/fonts/freefont/FreeSans.otf
|
||||
|
||||
# Copy fonts from download stage
|
||||
COPY --from=download /fonts /fonts
|
||||
COPY --from=download /pdfium-linux /pdfium-linux
|
||||
|
||||
# Install PDFium library
|
||||
RUN cp /pdfium-linux/lib/libpdfium.so /usr/local/lib/ && \
|
||||
chmod +x /usr/local/lib/libpdfium.so
|
||||
|
||||
# OpenSSL legacy configuration for compatibility
|
||||
RUN echo $'.include = /etc/ssl/openssl.cnf\n\
|
||||
\n\
|
||||
[provider_sect]\n\
|
||||
default = default_sect\n\
|
||||
legacy = legacy_sect\n\
|
||||
\n\
|
||||
[default_sect]\n\
|
||||
activate = 1\n\
|
||||
\n\
|
||||
[legacy_sect]\n\
|
||||
activate = 1' >> /app/openssl_legacy.cnf
|
||||
|
||||
# Copy Gemfile and package.json for dependency installation
|
||||
COPY ./Gemfile ./Gemfile.lock ./
|
||||
COPY ./package.json ./yarn.lock ./
|
||||
|
||||
# Install Ruby gems and Node packages
|
||||
RUN bundle install && \
|
||||
yarn install --network-timeout 1000000
|
||||
|
||||
# Install shakapacker for asset compilation
|
||||
RUN gem install shakapacker
|
||||
|
||||
# Create necessary directories
|
||||
RUN mkdir -p log tmp/pids tmp/cache tmp/sockets public/assets
|
||||
|
||||
# Set up the application
|
||||
COPY ./bin ./bin
|
||||
RUN chmod +x ./bin/*
|
||||
|
||||
# Expose port 3000
|
||||
EXPOSE 3000
|
||||
|
||||
# Default command for development
|
||||
CMD ["bundle", "exec", "rails", "server", "-b", "0.0.0.0"]
|
||||
@ -0,0 +1,221 @@
|
||||
# DocuSeal Omniauth Implementation Guide
|
||||
|
||||
This document describes the complete implementation of omniauth/SSO functionality in DocuSeal, restoring the features that were previously gated behind paywall checks.
|
||||
|
||||
## Overview
|
||||
|
||||
We have successfully implemented comprehensive omniauth support with the following providers:
|
||||
- **SAML 2.0** - For enterprise SSO integration
|
||||
- **Google OAuth2** - For Google account authentication
|
||||
- **Microsoft Graph** - For Microsoft/Office 365 authentication
|
||||
|
||||
## What Was Implemented
|
||||
|
||||
### 1. Database Schema Changes
|
||||
- Added `provider` and `uid` columns to the `users` table
|
||||
- Created migration: `db/migrate/20250719104801_add_omniauth_to_users.rb`
|
||||
- Added unique index on `[provider, uid]` combination
|
||||
|
||||
### 2. User Model Updates
|
||||
- Added `:omniauthable` to Devise modules
|
||||
- Configured omniauth providers: `%i[saml google_oauth2 microsoft_graph]`
|
||||
- Implemented `User.from_omniauth(auth)` class method for handling authentication callbacks
|
||||
- Added support for both single-tenant and multi-tenant account creation
|
||||
|
||||
### 3. Devise Configuration
|
||||
- Updated `config/initializers/devise.rb` with omniauth provider configurations
|
||||
- Added environment variable-based configuration for SAML
|
||||
- Configured Google OAuth2 and Microsoft Graph providers
|
||||
- Added proper attribute mapping for SAML assertions
|
||||
|
||||
### 4. Controllers
|
||||
- Created `app/controllers/users/omniauth_callbacks_controller.rb`
|
||||
- Handles callbacks for all three providers (SAML, Google, Microsoft)
|
||||
- Includes proper error handling and session management
|
||||
- Updated `app/controllers/sso_settings_controller.rb` with configuration management
|
||||
|
||||
### 5. Views and UI
|
||||
- Replaced SSO paywall placeholder with functional SAML configuration form
|
||||
- Updated login form to include all three authentication providers
|
||||
- Added SSO settings interface for SAML configuration
|
||||
- Removed `Docuseal.multitenant?` checks that were gating SSO features
|
||||
|
||||
### 6. Routes
|
||||
- Updated routes to include omniauth callbacks
|
||||
- Added update action to SSO settings controller
|
||||
- Enabled SSO settings for all users (removed paywall restrictions)
|
||||
|
||||
### 7. Gemfile Dependencies
|
||||
Added the following gems:
|
||||
```ruby
|
||||
gem 'omniauth'
|
||||
gem 'omniauth-rails_csrf_protection'
|
||||
gem 'omniauth-saml'
|
||||
gem 'omniauth-google-oauth2'
|
||||
gem 'omniauth-microsoft_graph'
|
||||
```
|
||||
|
||||
### 8. Development Environment
|
||||
- Created `Dockerfile.dev` for development with mounted codebase
|
||||
- Created `docker-compose.dev.yml` for local development environment
|
||||
- Configured development environment with PostgreSQL and Redis
|
||||
|
||||
## Configuration
|
||||
|
||||
### SAML Configuration
|
||||
|
||||
#### Environment Variables
|
||||
Set these environment variables for SAML configuration:
|
||||
```bash
|
||||
SAML_IDP_SSO_SERVICE_URL=https://your-idp.com/sso/saml
|
||||
SAML_IDP_CERT_FINGERPRINT=AA:BB:CC:DD:EE:FF:00:11:22:33:44:55:66:77:88:99:AA:BB:CC:DD
|
||||
SAML_SP_ENTITY_ID=docuseal
|
||||
APP_URL=http://localhost:3000
|
||||
```
|
||||
|
||||
#### Database Configuration
|
||||
Alternatively, configure SAML through the web interface at `/settings/sso` which stores encrypted configuration in the database.
|
||||
|
||||
#### Service Provider URLs
|
||||
Provide these URLs to your Identity Provider:
|
||||
- **Assertion Consumer Service URL**: `http://localhost:3000/users/auth/saml/callback`
|
||||
- **SP Metadata URL**: `http://localhost:3000/users/auth/saml/metadata`
|
||||
- **SP Entity ID**: `docuseal` (or your custom value)
|
||||
|
||||
### Google OAuth2 Configuration
|
||||
|
||||
Add to Rails credentials or environment variables:
|
||||
```bash
|
||||
GOOGLE_CLIENT_ID=your-google-client-id
|
||||
GOOGLE_CLIENT_SECRET=your-google-client-secret
|
||||
```
|
||||
|
||||
### Microsoft Graph Configuration
|
||||
|
||||
Add to Rails credentials or environment variables:
|
||||
```bash
|
||||
MICROSOFT_CLIENT_ID=your-microsoft-client-id
|
||||
MICROSOFT_CLIENT_SECRET=your-microsoft-client-secret
|
||||
```
|
||||
|
||||
## Usage
|
||||
|
||||
### For Users
|
||||
1. Navigate to the login page
|
||||
2. Choose from available authentication methods:
|
||||
- Sign in with Google
|
||||
- Sign in with Microsoft
|
||||
- Sign in with SAML SSO (if configured)
|
||||
3. Complete authentication with your chosen provider
|
||||
4. You'll be automatically signed in or prompted to complete registration
|
||||
|
||||
### For Administrators
|
||||
1. Go to Settings → SSO
|
||||
2. Configure SAML settings with your Identity Provider details
|
||||
3. Test the configuration using the "Test SAML Login" button
|
||||
4. Users can now authenticate using the configured SSO provider
|
||||
|
||||
## Development Setup
|
||||
|
||||
### Using Docker (Recommended)
|
||||
```bash
|
||||
# Build the development environment
|
||||
docker-compose -f docker-compose.dev.yml build
|
||||
|
||||
# Start the development environment
|
||||
docker-compose -f docker-compose.dev.yml up
|
||||
|
||||
# Access the application at http://localhost:3000
|
||||
```
|
||||
|
||||
### Local Development
|
||||
```bash
|
||||
# Install dependencies
|
||||
bundle install
|
||||
yarn install
|
||||
|
||||
# Run database migrations
|
||||
rails db:create db:migrate
|
||||
|
||||
# Start the development server
|
||||
rails server
|
||||
```
|
||||
|
||||
## Testing
|
||||
|
||||
### SAML Testing
|
||||
1. Set up environment variables for SAML configuration
|
||||
2. Navigate to `/settings/sso` to configure SAML
|
||||
3. Use the "Test SAML Login" button to verify configuration
|
||||
4. Check logs for any authentication errors
|
||||
|
||||
### OAuth Testing
|
||||
1. Configure Google/Microsoft credentials
|
||||
2. Navigate to login page
|
||||
3. Click "Sign in with Google" or "Sign in with Microsoft"
|
||||
4. Complete OAuth flow and verify user creation/authentication
|
||||
|
||||
## Security Considerations
|
||||
|
||||
1. **CSRF Protection**: Implemented via `omniauth-rails_csrf_protection` gem
|
||||
2. **Secure Credentials**: Store sensitive configuration in Rails credentials or environment variables
|
||||
3. **Certificate Validation**: SAML certificate fingerprints are validated
|
||||
4. **Session Management**: Proper session cleanup and management implemented
|
||||
|
||||
## Troubleshooting
|
||||
|
||||
### Common Issues
|
||||
|
||||
1. **"NameError: uninitialized constant EncryptedConfig"**
|
||||
- This was resolved by moving SAML configuration to environment variables
|
||||
- Ensure proper initialization order in Devise configuration
|
||||
|
||||
2. **"Invalid credentials" errors**
|
||||
- Verify OAuth client IDs and secrets are correct
|
||||
- Check redirect URIs match exactly
|
||||
|
||||
3. **SAML authentication failures**
|
||||
- Verify IdP certificate fingerprint is correct
|
||||
- Check that assertion consumer service URL matches
|
||||
- Ensure name identifier format matches IdP configuration
|
||||
|
||||
### Logs
|
||||
Check application logs for detailed error messages:
|
||||
```bash
|
||||
docker-compose -f docker-compose.dev.yml logs app
|
||||
```
|
||||
|
||||
## Files Modified/Created
|
||||
|
||||
### New Files
|
||||
- `db/migrate/20250719104801_add_omniauth_to_users.rb`
|
||||
- `app/controllers/users/omniauth_callbacks_controller.rb`
|
||||
- `app/views/sso_settings/_saml_form.html.erb`
|
||||
- `Dockerfile.dev`
|
||||
- `docker-compose.dev.yml`
|
||||
- `OMNIAUTH_IMPLEMENTATION.md`
|
||||
|
||||
### Modified Files
|
||||
- `Gemfile` - Added omniauth gems
|
||||
- `app/models/user.rb` - Added omniauthable and from_omniauth method
|
||||
- `config/initializers/devise.rb` - Added omniauth provider configurations
|
||||
- `app/controllers/sso_settings_controller.rb` - Added update method
|
||||
- `app/views/sso_settings/index.html.erb` - Replaced placeholder with form
|
||||
- `app/views/devise/sessions/new.html.erb` - Added omniauth provider buttons
|
||||
- `app/views/shared/_settings_nav.html.erb` - Removed paywall check
|
||||
- `config/routes.rb` - Added update route for SSO settings
|
||||
|
||||
## Next Steps
|
||||
|
||||
1. **Production Deployment**: Configure production environment variables
|
||||
2. **Additional Providers**: Add more omniauth providers as needed
|
||||
3. **Advanced SAML**: Implement IdP-initiated SSO and SLO (Single Logout)
|
||||
4. **User Management**: Add admin interface for managing SSO users
|
||||
5. **Audit Logging**: Add logging for SSO authentication events
|
||||
|
||||
## Support
|
||||
|
||||
For issues or questions about this implementation, refer to:
|
||||
- [Devise Omniauth Documentation](https://github.com/heartcombo/devise/wiki/OmniAuth:-Overview)
|
||||
- [Omniauth SAML Documentation](https://github.com/omniauth/omniauth-saml)
|
||||
- DocuSeal application logs and error messages
|
||||
@ -0,0 +1,141 @@
|
||||
# frozen_string_literal: true
|
||||
|
||||
class Users::OmniauthCallbacksController < Devise::OmniauthCallbacksController
|
||||
# See https://github.com/omniauth/omniauth/wiki/FAQ#rails-session-is-clobbered-after-callback-on-developer-strategy
|
||||
skip_before_action :verify_authenticity_token, only: [:saml, :google_oauth2, :microsoft_graph]
|
||||
|
||||
def saml
|
||||
handle_omniauth_callback('SAML')
|
||||
end
|
||||
|
||||
def google_oauth2
|
||||
handle_omniauth_callback('Google')
|
||||
end
|
||||
|
||||
def microsoft_graph
|
||||
handle_omniauth_callback('Microsoft')
|
||||
end
|
||||
|
||||
def failure
|
||||
Rails.logger.error "Omniauth failure: #{params[:message]}"
|
||||
redirect_to new_user_session_path, alert: "Authentication failed: #{params[:message]}"
|
||||
end
|
||||
|
||||
def passthru
|
||||
# Handle requests to unconfigured or improperly configured SSO providers
|
||||
provider = params[:provider] || request.env['omniauth.strategy']&.name&.to_s
|
||||
|
||||
case provider
|
||||
when 'saml'
|
||||
# Check if SAML is properly configured anywhere in the system
|
||||
saml_configured = false
|
||||
|
||||
# Check environment variables first
|
||||
if ENV['SAML_IDP_SSO_SERVICE_URL'].present? && ENV['SAML_IDP_CERT_FINGERPRINT'].present?
|
||||
saml_configured = true
|
||||
else
|
||||
# Check if any account has SAML configured in database
|
||||
saml_config_record = EncryptedConfig.find_by(key: 'saml_configs')
|
||||
if saml_config_record&.value.present?
|
||||
begin
|
||||
config = JSON.parse(saml_config_record.value)
|
||||
saml_configured = config['idp_sso_service_url'].present? && config['idp_cert_fingerprint'].present?
|
||||
rescue JSON::ParserError
|
||||
# Invalid JSON, treat as not configured
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
unless saml_configured
|
||||
redirect_to new_user_session_path, alert: 'SAML SSO is not configured. Please contact your administrator to set up SAML authentication.'
|
||||
return
|
||||
end
|
||||
when 'google_oauth2'
|
||||
if Rails.application.credentials.google_client_id.blank? || Rails.application.credentials.google_client_id == 'placeholder_client_id'
|
||||
redirect_to new_user_session_path, alert: 'Google OAuth is not configured. Please contact your administrator to set up Google authentication.'
|
||||
return
|
||||
end
|
||||
when 'microsoft_graph'
|
||||
if Rails.application.credentials.microsoft_client_id.blank? || Rails.application.credentials.microsoft_client_id == 'placeholder_client_id'
|
||||
redirect_to new_user_session_path, alert: 'Microsoft OAuth is not configured. Please contact your administrator to set up Microsoft authentication.'
|
||||
return
|
||||
end
|
||||
end
|
||||
|
||||
# If we get here, redirect to configuration page
|
||||
provider_name = provider&.humanize || 'SSO'
|
||||
redirect_to new_user_session_path, alert: "#{provider_name} authentication is not available. Please contact your administrator."
|
||||
end
|
||||
|
||||
def metadata
|
||||
# Generate basic SAML metadata for the service provider
|
||||
entity_id = ENV.fetch('SAML_SP_ENTITY_ID', 'docuseal')
|
||||
app_url = ENV.fetch('APP_URL', 'http://localhost:3000')
|
||||
callback_url = "#{app_url}/auth/saml/callback"
|
||||
|
||||
# Build comprehensive SP metadata XML
|
||||
logout_url = "#{app_url}/sign_out"
|
||||
|
||||
metadata_xml = <<~XML
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
|
||||
entityID="#{entity_id}">
|
||||
<md:SPSSODescriptor
|
||||
AuthnRequestsSigned="false"
|
||||
WantAssertionsSigned="true"
|
||||
protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
|
||||
|
||||
<!-- Name ID Format -->
|
||||
<md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</md:NameIDFormat>
|
||||
|
||||
<!-- Assertion Consumer Services -->
|
||||
<md:AssertionConsumerService
|
||||
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
|
||||
Location="#{callback_url}"
|
||||
index="0"
|
||||
isDefault="true" />
|
||||
<md:AssertionConsumerService
|
||||
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
|
||||
Location="#{callback_url}"
|
||||
index="1" />
|
||||
|
||||
<!-- Single Logout Service -->
|
||||
<md:SingleLogoutService
|
||||
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
|
||||
Location="#{logout_url}" />
|
||||
<md:SingleLogoutService
|
||||
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
|
||||
Location="#{logout_url}" />
|
||||
|
||||
</md:SPSSODescriptor>
|
||||
</md:EntityDescriptor>
|
||||
XML
|
||||
|
||||
response.headers['Content-Disposition'] = 'attachment; filename="saml-metadata.xml"'
|
||||
render xml: metadata_xml, content_type: 'application/samlmetadata+xml'
|
||||
end
|
||||
|
||||
private
|
||||
|
||||
def handle_omniauth_callback(provider_name)
|
||||
@user = User.from_omniauth(request.env['omniauth.auth'])
|
||||
|
||||
if @user&.persisted?
|
||||
sign_in_and_redirect @user, event: :authentication
|
||||
set_flash_message(:notice, :success, kind: provider_name) if is_navigational_format?
|
||||
else
|
||||
# Store the omniauth data in session for potential account linking
|
||||
session['devise.omniauth_data'] = request.env['omniauth.auth'].except(:extra)
|
||||
|
||||
# Redirect to registration with error message
|
||||
redirect_to new_user_registration_url,
|
||||
alert: "There was an issue with your #{provider_name} account. Please try again or contact support."
|
||||
end
|
||||
rescue StandardError => e
|
||||
Rails.logger.error "Omniauth callback error: #{e.message}"
|
||||
Rails.logger.error e.backtrace.join("\n")
|
||||
|
||||
redirect_to new_user_session_path,
|
||||
alert: "Authentication failed. Please try again or contact support."
|
||||
end
|
||||
end
|
||||
@ -0,0 +1,52 @@
|
||||
# frozen_string_literal: true
|
||||
|
||||
class SamlConfigService
|
||||
def self.load_config(account = nil)
|
||||
# Try to load from database first
|
||||
if account
|
||||
config_record = EncryptedConfig.find_by(account: account, key: 'saml_configs')
|
||||
if config_record&.value.present?
|
||||
return JSON.parse(config_record.value).with_indifferent_access
|
||||
end
|
||||
end
|
||||
|
||||
# Fall back to environment variables
|
||||
{
|
||||
idp_sso_service_url: ENV['SAML_IDP_SSO_SERVICE_URL'],
|
||||
idp_cert_fingerprint: ENV['SAML_IDP_CERT_FINGERPRINT'],
|
||||
sp_entity_id: ENV.fetch('SAML_SP_ENTITY_ID', 'docuseal'),
|
||||
name_identifier_format: 'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress',
|
||||
email_attribute: 'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress',
|
||||
first_name_attribute: 'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname',
|
||||
last_name_attribute: 'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname',
|
||||
name_attribute: 'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name'
|
||||
}.with_indifferent_access
|
||||
rescue => e
|
||||
Rails.logger.warn "Could not load SAML config: #{e.message}"
|
||||
{}
|
||||
end
|
||||
|
||||
def self.configured?(account = nil)
|
||||
config = load_config(account)
|
||||
config[:idp_sso_service_url].present? && config[:idp_cert_fingerprint].present?
|
||||
end
|
||||
|
||||
def self.omniauth_config(account = nil)
|
||||
config = load_config(account)
|
||||
return nil unless configured?(account)
|
||||
|
||||
{
|
||||
assertion_consumer_service_url: "#{ENV.fetch('APP_URL', 'http://localhost:3000')}/auth/saml/callback",
|
||||
sp_entity_id: config[:sp_entity_id],
|
||||
idp_sso_service_url: config[:idp_sso_service_url],
|
||||
idp_cert_fingerprint: config[:idp_cert_fingerprint],
|
||||
name_identifier_format: config[:name_identifier_format],
|
||||
attribute_statements: {
|
||||
email: [config[:email_attribute]],
|
||||
first_name: [config[:first_name_attribute]],
|
||||
last_name: [config[:last_name_attribute]],
|
||||
name: [config[:name_attribute]]
|
||||
}
|
||||
}
|
||||
end
|
||||
end
|
||||
@ -0,0 +1,160 @@
|
||||
<%= form_with model: @encrypted_config, url: settings_sso_path, method: :patch, local: true, multipart: true, class: "space-y-4" do |f| %>
|
||||
<div class="space-y-6">
|
||||
<div class="alert alert-info">
|
||||
<%= svg_icon('info_circle', class: 'w-6 h-6') %>
|
||||
<div>
|
||||
<p class="font-bold">SAML SSO Configuration</p>
|
||||
<p class="text-gray-700">
|
||||
Configure SAML 2.0 Single Sign-On for your organization. Users will be able to sign in using your identity provider.
|
||||
</p>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<% saml_config = @encrypted_config.value.present? ? JSON.parse(@encrypted_config.value) : {} %>
|
||||
|
||||
<!-- IdP Metadata Upload Section -->
|
||||
<div class="card bg-base-100 border border-base-300">
|
||||
<div class="card-body">
|
||||
<h3 class="card-title text-lg">Quick Setup: Upload IdP Metadata</h3>
|
||||
<p class="text-sm text-gray-600 mb-4">
|
||||
Upload your Identity Provider's metadata XML file to automatically populate the configuration below.
|
||||
</p>
|
||||
|
||||
<div class="form-control">
|
||||
<%= label_tag 'idp_metadata_file', 'IdP Metadata XML File', class: 'label' %>
|
||||
<%= file_field_tag 'idp_metadata_file',
|
||||
accept: '.xml,application/xml,text/xml',
|
||||
class: 'file-input file-input-bordered w-full' %>
|
||||
<div class="label">
|
||||
<span class="label-text-alt">Select your IdP's metadata.xml file to auto-configure SAML settings</span>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div class="card-actions justify-end mt-4">
|
||||
<%= submit_tag 'Parse Metadata', class: 'btn btn-primary btn-sm' %>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div class="divider">OR configure manually</div>
|
||||
|
||||
<div class="form-control">
|
||||
<%= label_tag 'saml_config[idp_sso_service_url]', 'Identity Provider SSO URL', class: 'label' %>
|
||||
<%= text_field_tag 'saml_config[idp_sso_service_url]', saml_config['idp_sso_service_url'],
|
||||
class: 'input input-bordered w-full',
|
||||
placeholder: 'https://your-idp.com/sso/saml',
|
||||
required: true %>
|
||||
<div class="label">
|
||||
<span class="label-text-alt">The URL where users will be redirected to authenticate</span>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div class="form-control">
|
||||
<%= label_tag 'saml_config[idp_cert_fingerprint]', 'Identity Provider Certificate Fingerprint', class: 'label' %>
|
||||
<%= text_field_tag 'saml_config[idp_cert_fingerprint]', saml_config['idp_cert_fingerprint'],
|
||||
class: 'input input-bordered w-full',
|
||||
placeholder: 'AA:BB:CC:DD:EE:FF:00:11:22:33:44:55:66:77:88:99:AA:BB:CC:DD',
|
||||
required: true %>
|
||||
<div class="label">
|
||||
<span class="label-text-alt">SHA1 fingerprint of your IdP's certificate</span>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div class="form-control">
|
||||
<%= label_tag 'saml_config[sp_entity_id]', 'Service Provider Entity ID', class: 'label' %>
|
||||
<%= text_field_tag 'saml_config[sp_entity_id]', saml_config['sp_entity_id'] || 'docuseal',
|
||||
class: 'input input-bordered w-full',
|
||||
placeholder: 'docuseal',
|
||||
required: true %>
|
||||
<div class="label">
|
||||
<span class="label-text-alt">Unique identifier for this DocuSeal instance</span>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div class="form-control">
|
||||
<%= label_tag 'saml_config[name_identifier_format]', 'Name ID Format', class: 'label' %>
|
||||
<%= select_tag 'saml_config[name_identifier_format]',
|
||||
options_for_select([
|
||||
['Email Address', 'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress'],
|
||||
['Persistent', 'urn:oasis:names:tc:SAML:2.0:nameid-format:persistent'],
|
||||
['Transient', 'urn:oasis:names:tc:SAML:2.0:nameid-format:transient']
|
||||
], saml_config['name_identifier_format'] || 'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress'),
|
||||
class: 'select select-bordered w-full' %>
|
||||
<div class="label">
|
||||
<span class="label-text-alt">Format for the user identifier sent by your IdP</span>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div class="divider">Attribute Mapping</div>
|
||||
|
||||
<div class="form-control">
|
||||
<%= label_tag 'saml_config[email_attribute]', 'Email Attribute', class: 'label' %>
|
||||
<%= text_field_tag 'saml_config[email_attribute]',
|
||||
saml_config['email_attribute'] || 'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress',
|
||||
class: 'input input-bordered w-full',
|
||||
placeholder: 'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress' %>
|
||||
<div class="label">
|
||||
<span class="label-text-alt">SAML attribute name that contains the user's email</span>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div class="form-control">
|
||||
<%= label_tag 'saml_config[first_name_attribute]', 'First Name Attribute', class: 'label' %>
|
||||
<%= text_field_tag 'saml_config[first_name_attribute]',
|
||||
saml_config['first_name_attribute'] || 'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname',
|
||||
class: 'input input-bordered w-full',
|
||||
placeholder: 'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname' %>
|
||||
<div class="label">
|
||||
<span class="label-text-alt">SAML attribute name that contains the user's first name</span>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div class="form-control">
|
||||
<%= label_tag 'saml_config[last_name_attribute]', 'Last Name Attribute', class: 'label' %>
|
||||
<%= text_field_tag 'saml_config[last_name_attribute]',
|
||||
saml_config['last_name_attribute'] || 'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname',
|
||||
class: 'input input-bordered w-full',
|
||||
placeholder: 'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname' %>
|
||||
<div class="label">
|
||||
<span class="label-text-alt">SAML attribute name that contains the user's last name</span>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div class="divider">Service Provider Information</div>
|
||||
|
||||
<div class="alert">
|
||||
<%= svg_icon('info_circle', class: 'w-6 h-6') %>
|
||||
<div>
|
||||
<p class="font-bold">Configuration URLs for your Identity Provider</p>
|
||||
<div class="mt-2 space-y-1 text-sm">
|
||||
<p><strong>Assertion Consumer Service URL:</strong></p>
|
||||
<code class="bg-base-200 px-2 py-1 rounded text-xs"><%= "#{request.base_url}/auth/saml/callback" %></code>
|
||||
|
||||
<p class="mt-2"><strong>SP Metadata URL:</strong></p>
|
||||
<div class="flex items-center gap-2">
|
||||
<code class="bg-base-200 px-2 py-1 rounded text-xs flex-1"><%= "#{request.base_url}/auth/saml/metadata" %></code>
|
||||
<a href="<%= "#{request.base_url}/auth/saml/metadata" %>"
|
||||
class="btn btn-sm btn-outline"
|
||||
target="_blank"
|
||||
title="Download SAML Metadata">
|
||||
Download
|
||||
</a>
|
||||
</div>
|
||||
|
||||
<p class="mt-2"><strong>SP Entity ID:</strong></p>
|
||||
<code class="bg-base-200 px-2 py-1 rounded text-xs"><%= saml_config['sp_entity_id'] || 'docuseal' %></code>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div class="flex gap-2">
|
||||
<%= f.submit 'Save SAML Configuration', class: 'btn btn-primary' %>
|
||||
<% if @encrypted_config.persisted? && @encrypted_config.value.present? %>
|
||||
<%= link_to 'Test SAML Login', user_saml_omniauth_authorize_path,
|
||||
method: :post,
|
||||
class: 'btn btn-outline',
|
||||
data: { turbo: false } %>
|
||||
<% end %>
|
||||
</div>
|
||||
</div>
|
||||
<% end %>
|
||||
@ -0,0 +1,10 @@
|
||||
# frozen_string_literal: true
|
||||
|
||||
class AddOmniauthToUsers < ActiveRecord::Migration[7.1]
|
||||
def change
|
||||
add_column :users, :provider, :string
|
||||
add_column :users, :uid, :string
|
||||
|
||||
add_index :users, [:provider, :uid], unique: true
|
||||
end
|
||||
end
|
||||
@ -0,0 +1,89 @@
|
||||
services:
|
||||
app:
|
||||
depends_on:
|
||||
postgres:
|
||||
condition: service_healthy
|
||||
redis:
|
||||
condition: service_started
|
||||
build:
|
||||
context: .
|
||||
dockerfile: Dockerfile.dev
|
||||
tty: true
|
||||
stdin_open: true
|
||||
ports:
|
||||
- 3000:3000
|
||||
volumes:
|
||||
# Mount the entire codebase for live development
|
||||
- .:/app
|
||||
# Preserve node_modules and bundle cache
|
||||
- /app/node_modules
|
||||
- bundle_cache:/usr/local/bundle
|
||||
# Mount data directory
|
||||
- ./docuseal:/data/docuseal
|
||||
environment:
|
||||
- RAILS_ENV=development
|
||||
- NODE_ENV=development
|
||||
- DATABASE_URL=postgresql://postgres:postgres@postgres:5432/docuseal_development
|
||||
- REDIS_URL=redis://redis:6379/0
|
||||
- FORCE_SSL=false
|
||||
- SECRET_KEY_BASE=development_secret_key_base_change_in_production
|
||||
command: >
|
||||
sh -c "
|
||||
bundle install &&
|
||||
yarn install &&
|
||||
bundle exec rails db:create db:migrate &&
|
||||
rm -f /app/tmp/pids/server.pid &&
|
||||
bundle exec rails server -b 0.0.0.0
|
||||
"
|
||||
|
||||
postgres:
|
||||
image: postgres:15
|
||||
volumes:
|
||||
- postgres_data:/var/lib/postgresql/data
|
||||
environment:
|
||||
POSTGRES_USER: postgres
|
||||
POSTGRES_PASSWORD: postgres
|
||||
POSTGRES_DB: docuseal_development
|
||||
ports:
|
||||
- "5432:5432"
|
||||
healthcheck:
|
||||
test: ["CMD-SHELL", "pg_isready -U postgres"]
|
||||
interval: 5s
|
||||
timeout: 5s
|
||||
retries: 5
|
||||
|
||||
redis:
|
||||
image: redis:7-alpine
|
||||
ports:
|
||||
- "6379:6379"
|
||||
volumes:
|
||||
- redis_data:/data
|
||||
|
||||
# Optional: Sidekiq for background jobs
|
||||
sidekiq:
|
||||
depends_on:
|
||||
postgres:
|
||||
condition: service_healthy
|
||||
redis:
|
||||
condition: service_started
|
||||
build:
|
||||
context: .
|
||||
dockerfile: Dockerfile.dev
|
||||
volumes:
|
||||
- .:/app
|
||||
- /app/node_modules
|
||||
- bundle_cache:/usr/local/bundle
|
||||
environment:
|
||||
- RAILS_ENV=development
|
||||
- DATABASE_URL=postgresql://postgres:postgres@postgres:5432/docuseal_development
|
||||
- REDIS_URL=redis://redis:6379/0
|
||||
command: >
|
||||
sh -c "
|
||||
bundle install &&
|
||||
bundle exec sidekiq
|
||||
"
|
||||
|
||||
volumes:
|
||||
postgres_data:
|
||||
redis_data:
|
||||
bundle_cache:
|
||||
Loading…
Reference in new issue