github-starred/vikunja
2
0
Fork 0
mirror of https://github.com/go-vikunja/vikunja.git synced 2026-08-24 06:39:52 -05:00
Code Issues 690 Packages Projects Releases 13 Wiki Activity

[PR #2511] feat(auth): add SAML authentication with provider-based login flow #10040

New Issue
Open
opened 2026-04-23 09:21:55 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-04-23 09:21:55 -05:00
Owner
Copy Link
Copy Source

📋 Pull Request Information

Original PR: https://github.com/go-vikunja/vikunja/pull/2511
Author: @Sebastian-Brunow
Created: 3/31/2026
Status: 🔄 Open

Base: main ← Head: main

📝 Commits (7)

  • 4cba782 feat(auth): ✨ Add SAML authentication support
  • ac2d830 Merge pull request #1 from Sebastian-Brunow/feat/saml-auth
  • 6369794 feat(auth): ✨ Enhance SAML authentication handling
  • 3214af1 feat(auth): Add detailed SAML error handling
  • 1ed2880 feat(auth): Add SAML IDP integration and tests
  • 41f6f51 Merge branch 'go-vikunja:main' into main
  • bce7c4f Merge branch 'main' into main

📊 Changes

16 files changed (+841 additions, -73 deletions)

View changed files

📝 .github/workflows/test.yml (+10 -0)
📝 devenv.lock (+14 -71)
📝 frontend/src/constants/authRouteNames.ts (+1 -0)
📝 frontend/src/i18n/lang/en.json (+3 -0)
📝 frontend/src/router/index.ts (+6 -0)
📝 frontend/src/stores/config.ts (+9 -0)
➕ frontend/src/types/ISAMLProvider.ts (+4 -0)
📝 frontend/src/views/user/Login.vue (+22 -0)
➕ frontend/src/views/user/SAMLAuth.vue (+74 -0)
➕ frontend/tests/e2e/user/saml-login.spec.ts (+20 -0)
📝 go.mod (+6 -1)
📝 go.sum (+17 -0)
📝 pkg/config/config.go (+5 -0)
➕ pkg/modules/auth/saml/saml.go (+622 -0)
📝 pkg/routes/api/v1/info.go (+18 -0)
📝 pkg/routes/routes.go (+10 -1)

📄 Description

SAML Authentication Support (feat/auth)

Overview

This pull request adds SAML-based login support to Vikunja, including backend identity provider handling and frontend login flow.

Key Features

  • Backend SAML authentication module in pkg/modules/auth/saml/saml.go
  • New config keys and defaults in pkg/config/config.go
    • auth.saml.enabled
    • auth.saml.providers
  • SAML endpoints in pkg/routes/routes.go
    • GET /api/v1/auth/saml/:provider/login
    • POST /api/v1/auth/saml/:provider/acs
    • GET /api/v1/auth/saml/:provider/metadata
  • SAML provider info in /api/v1/info via pkg/routes/api/v1/info.go
  • Frontend provider action buttons added to frontend/src/views/user/Login.vue
  • New frontend callback route + view in frontend/src/views/user/SAMLAuth.vue
  • Config store extended with SAML shape in frontend/src/stores/config.ts
  • Type added: frontend/src/types/ISAMLProvider.ts
  • Router updates in frontend/src/router/index.ts
  • AUTH_ROUTE_NAMES updated in frontend/src/constants/authRouteNames.ts
  • English i18n messages added to frontend/src/i18n/lang/en.json
  • Go modules updated in go.mod / go.sum (crewjam/saml + deps)

Detailed Behavior

Provider lookup and caching

  • SAML providers are read from config at startup via GetAllProviders().
  • Provider entries support fields: name, metadataurl, metadatafile, certfile, keyfile.
  • Caching in keyvalue: saml_provider_<key>, saml_providers.

Login flow

  • UI lists SAML providers on login when configured.
  • redirectToSAMLProvider calls window.location.href = ${window.API_URL}/auth/saml/${provider.key}/login.
  • Backend constructs AuthnRequest and redirects to IdP.
  • IdP posts to ACS endpoint with SAMLResponse.
  • Backend validates assertion, maps NameID to email, name extraction, and token issuance.

Error handling

  • SAML error query params returned to the frontend:
    • saml_assertion_failed
    • no_email
  • Frontend resolves to i18n keys:
    • user.auth.samlAssertionFailed
    • user.auth.samlNoEmail
    • user.auth.samlError

Configuration Example

auth:
  saml:
    enabled: true
    providers:
      sso:
        name: "SSO"
        metadatafile: /app/vikunja/files/SSOMetadata.xml

IdP setup

  • ACS URL: https://<your-server-ip>/api/v1/auth/saml/sso/acs
  • Entity ID (SP metadata): https://<your-server-ip>/api/v1/auth/saml/sso/metadata
  • NameID: must contain the user email address (used as the login identity)

Supported attributes for display name:

  • displayName

Fallback attributes (if no display name is provided):

  • Given name:
    • givenName
  • Surname:
    • surname

If no supported name attributes are present, the email is used as the display name.

Test Notes

  1. GET /api/v1/info includes auth.saml.providers when enabled.
  2. Login screen shows provider buttons when SAML enabled.
  3. Redirection to /api/v1/auth/saml/:provider/login works.
  4. ACS flow handles token and frontend route /auth/saml/:provider?token=.
  5. Error flows show localized messages.

Changelog

  • feat: added SAML auth provider support to Vikunja.
  • feat: added errors for failed SAML assertion and missing email.
  • docs: added configuration example for SAML in PR summary.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/go-vikunja/vikunja/pull/2511 **Author:** [@Sebastian-Brunow](https://github.com/Sebastian-Brunow) **Created:** 3/31/2026 **Status:** 🔄 Open **Base:** `main` ← **Head:** `main` --- ### 📝 Commits (7) - [`4cba782`](https://github.com/go-vikunja/vikunja/commit/4cba78241543dce5485b4972241ddc0042d6333d) feat(auth): ✨ Add SAML authentication support - [`ac2d830`](https://github.com/go-vikunja/vikunja/commit/ac2d8300a71e7111ae877bb3ece298f95ae8d51b) Merge pull request #1 from Sebastian-Brunow/feat/saml-auth - [`6369794`](https://github.com/go-vikunja/vikunja/commit/6369794fa46ec8b3dc28e965007a4bda74533dd4) feat(auth): ✨ Enhance SAML authentication handling - [`3214af1`](https://github.com/go-vikunja/vikunja/commit/3214af1cba868b96c08aa7e8fddec319ea15e886) feat(auth): Add detailed SAML error handling - [`1ed2880`](https://github.com/go-vikunja/vikunja/commit/1ed28801a96099a94eb5870ca3198b5190a6b9c5) feat(auth): Add SAML IDP integration and tests - [`41f6f51`](https://github.com/go-vikunja/vikunja/commit/41f6f51b9e410e804b84c16a22e21a4d5964eee2) Merge branch 'go-vikunja:main' into main - [`bce7c4f`](https://github.com/go-vikunja/vikunja/commit/bce7c4fa02ce987f3ea65e9485657c1fdd4e981b) Merge branch 'main' into main ### 📊 Changes **16 files changed** (+841 additions, -73 deletions) <details> <summary>View changed files</summary> 📝 `.github/workflows/test.yml` (+10 -0) 📝 `devenv.lock` (+14 -71) 📝 `frontend/src/constants/authRouteNames.ts` (+1 -0) 📝 `frontend/src/i18n/lang/en.json` (+3 -0) 📝 `frontend/src/router/index.ts` (+6 -0) 📝 `frontend/src/stores/config.ts` (+9 -0) ➕ `frontend/src/types/ISAMLProvider.ts` (+4 -0) 📝 `frontend/src/views/user/Login.vue` (+22 -0) ➕ `frontend/src/views/user/SAMLAuth.vue` (+74 -0) ➕ `frontend/tests/e2e/user/saml-login.spec.ts` (+20 -0) 📝 `go.mod` (+6 -1) 📝 `go.sum` (+17 -0) 📝 `pkg/config/config.go` (+5 -0) ➕ `pkg/modules/auth/saml/saml.go` (+622 -0) 📝 `pkg/routes/api/v1/info.go` (+18 -0) 📝 `pkg/routes/routes.go` (+10 -1) </details> ### 📄 Description # SAML Authentication Support (feat/auth) ## Overview This pull request adds SAML-based login support to Vikunja, including backend identity provider handling and frontend login flow. ## Key Features - Backend SAML authentication module in `pkg/modules/auth/saml/saml.go` - New config keys and defaults in `pkg/config/config.go` - `auth.saml.enabled` - `auth.saml.providers` - SAML endpoints in `pkg/routes/routes.go` - `GET /api/v1/auth/saml/:provider/login` - `POST /api/v1/auth/saml/:provider/acs` - `GET /api/v1/auth/saml/:provider/metadata` - SAML provider info in `/api/v1/info` via `pkg/routes/api/v1/info.go` - Frontend provider action buttons added to `frontend/src/views/user/Login.vue` - New frontend callback route + view in `frontend/src/views/user/SAMLAuth.vue` - Config store extended with SAML shape in `frontend/src/stores/config.ts` - Type added: `frontend/src/types/ISAMLProvider.ts` - Router updates in `frontend/src/router/index.ts` - `AUTH_ROUTE_NAMES` updated in `frontend/src/constants/authRouteNames.ts` - English i18n messages added to `frontend/src/i18n/lang/en.json` - Go modules updated in `go.mod` / `go.sum` (crewjam/saml + deps) ## Detailed Behavior ### Provider lookup and caching - SAML providers are read from config at startup via `GetAllProviders()`. - Provider entries support fields: `name`, `metadataurl`, `metadatafile`, `certfile`, `keyfile`. - Caching in keyvalue: `saml_provider_<key>`, `saml_providers`. ### Login flow - UI lists SAML providers on login when configured. - `redirectToSAMLProvider` calls `window.location.href = ${window.API_URL}/auth/saml/${provider.key}/login`. - Backend constructs AuthnRequest and redirects to IdP. - IdP posts to `ACS` endpoint with SAMLResponse. - Backend validates assertion, maps NameID to email, name extraction, and token issuance. ### Error handling - SAML error query params returned to the frontend: - `saml_assertion_failed` - `no_email` - Frontend resolves to i18n keys: - `user.auth.samlAssertionFailed` - `user.auth.samlNoEmail` - `user.auth.samlError` ## Configuration Example ```yaml auth: saml: enabled: true providers: sso: name: "SSO" metadatafile: /app/vikunja/files/SSOMetadata.xml ``` ### IdP setup - ACS URL: `https://<your-server-ip>/api/v1/auth/saml/sso/acs` - Entity ID (SP metadata): `https://<your-server-ip>/api/v1/auth/saml/sso/metadata` - NameID: must contain the user email address (used as the login identity) Supported attributes for display name: - `displayName` Fallback attributes (if no display name is provided): - Given name: - `givenName` - Surname: - `surname` If no supported name attributes are present, the email is used as the display name. ## Test Notes 1. `GET /api/v1/info` includes `auth.saml.providers` when enabled. 2. Login screen shows provider buttons when SAML enabled. 3. Redirection to `/api/v1/auth/saml/:provider/login` works. 4. ACS flow handles token and frontend route `/auth/saml/:provider?token=`. 5. Error flows show localized messages. ## Changelog - feat: added SAML auth provider support to Vikunja. - feat: added errors for failed SAML assertion and missing email. - docs: added configuration example for SAML in PR summary. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
GiteaMirror added the pull-request label 2026-04-23 09:21:55 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
area/api
area/attachments
area/auth
area/avatars
area/backup-restore
area/caldav
area/calendar-view
area/comments
area/config
area/database
area/desktop
area/docker
area/email
area/favorites
area/filters
area/frontend
area/gantt
area/i18n
area/import-export
area/internal-code
area/kanban
area/labels
area/list-view
area/mobile
area/notifications
area/permissions
area/projects
area/pwa
area/recurring-tasks
area/reminders
area/search
area/shortcuts
area/subtasks
area/sync
area/table-view
area/task-editor
area/task-metadata
area/task-relations
area/teams
area/theming
area/time-tracking
area/typesense
area/views
area/webhooks
bug
changes requested
concern/accessibility
concern/performance
concern/regression
concern/ux
confirmed
db/mysql
dependencies
enhancement
good first issue
help wanted
integration/inbound
integration/outbound
kind/bug
kind/feature
needs reproduction
pull-request
Mirrored from GitHub Pull Request
 pull-request
Mirrored from GitHub Pull Request
 pull-request
Mirrored from GitHub Pull Request
 question
security
support
upstream issue
waiting for reply
wontfix
No labels pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
GiteaMirror ninjasurge (Kaehlen Rog)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/vikunja#10040