Does this support IDP initiated log-in?

[tathougies]

Trying to use this with a custom app and Google GSuite. Things work when logging in via the /authreq endpoint, but not when I initiate from Google Admin. I get AccessDenied {_avReasons = [DeniedBadInResponseTos {deniedDetails = "not found"}]})

I believe this is because the SAML doesn't have an inResponseTo field:

_subjectConfirmations = [SubjectConfirmation {_scMethod = SubjectConfirmationMethodBearer, _scData = Just (SubjectConfirmationData {_scdNotBefore = Nothing, _scdNotOnOrAfter = "2020-10-10T23:04:52.166Z", _scdRecipient = URI {uriScheme = Scheme {schemeBS = "https"}, uriAuthority = Just (Authority {authorityUserInfo = Nothing, authorityHost = Host {hostBS = "scrubbed"}, authorityPort = Nothing}), uriPath = "/api/sso/0a27a1d1-8417-51dc-a135-6f24ca031402/authresp", uriQuery = Query {queryPairs = []}, uriFragment = Nothing}, _scdInResponseTo = Nothing, _scdAddress = Nothing})}]

[fisx]

It does not: https://docs.wire.com/how-to/single-sign-on/trouble-shooting.html#why-does-the-auth-response-not-contain-a-reference-to-an-auth-request-also-can-i-use-idp-initiated-login

This package is more specific to its one bit user wire-server than originally intended. In fact, we are talking about moving it into the wire-server repo.

I will leave this issue open, because at the very least the error message should be more helpful.

[fisx]

thanks @tathougies for reporting! are you thinking about using this seriously? if so you may want to plan in some time for library maintenance, but we're certainly interested in helping!

[tathougies]

I am planning on using it seriously, at least as a starting point. HSaml2 is a nice support lib, but I don't have time to build out the entirety of SP functionality. Why not just contribute the library to the community and let people contribute instead of rolling it up. IMO, availability of these kinds of libraries makes the whole Haskell ecosystem better.

[fisx]

I am planning on using it seriously, at least as a starting point. HSaml2 is a nice support lib, but I don't have time to build out the entirety of SP functionality. Why not just contribute the library to the community and let people contribute instead of rolling it up. IMO, availability of these kinds of libraries makes the whole Haskell ecosystem better.

we'll consider this!

it's just that currently, the library has only one use case, and you can tell that from the code. in this situation, having a library just makes it harder to change code.

but if you're thinking of contributing, that changes things, and it will be a better deal for us to keep it here, and help turning it into something more mature. :-)