Support SAML 2.0 as Login-Source (Service Provider)

[frostieDE]

It would be nice to be able to configure Gitea as a SAML service provider in order to integrate Gitea with a corporate Single-Sign-On mechanism.

[techknowlogick]

@frostieDE which IDP are you using (so that it can be tested against)?

[nigeltiany]

gSuite/Google Admin is a good test

[frostieDE]

We are using an own implementation of a SAML IdP, you may use https://github.com/capriza/samling or https://simplesamlphp.org/ for testing (but I hope there is a library for SAML stuff) :-)

[jtl999]

@frostieDE Very interesting with regards to your IdP implementation. I too think this would be a great feature for Gitea.

[frostieDE]

This library looks promising: https://github.com/crewjam/saml

Unfortunately, I do not have any experience with Go programming 😄

[d-Pixie]

I was also looking for a good way to extend our G Suite identities into Gitea. Any thoughts on this internally @techknowlogick ?

[lpar]

I have experience integrating Go web applications with IBM's SAML infrastructure. I've successfully used https://github.com/russellhaering/gosaml2 for the task.

[techknowlogick]

@d-Pixie you could use OpenID Connect (Oauth2) for GSuite for now.

I second @lpar's suggestion of https://github.com/russellhaering/gosaml2 as having used it and crewjam's, I prefer ressell's.

[chb0github]

Is SAML supported? I'm confused.

[fuero]

As SAML based authentication has lots of login flow scenarios with libraries in different languages supporting them often poorly, I'd suggest leaving the heavy SAML2 lifting to a proxy/preauthentication scenario.
Examples given are for the Shibboleth SAML2 reference SP implementation.

How it would work:

• Set up a webserver in front of gitea with lazy saml2 session initialization
• Introduce config settings in gitea to map HTTP Headers to user id and roles/groups, similar to the attribute mapping done for LDAP. (e.g. REMOTE_USER, uid, entitlement, X-Forwarded-*, etc.)
• Make header name and header value to group mapping configurable (e.g.: entitlement = https://gitea.example.com/role/([^/]+) -> $1, mapping https://gitea.example.com/role/admin to the admin group)
• Redirect the user on login to a configurable "magic url" (e.g. /Shibboleth.sso/Login)
• Verify a SAML session via presence of a configurable HTTP Header (e.g. Shib_Session_ID)

[Zocker1999NET]

@fuero Good idea, this would allow Gitea to "support" any authentication scheme available. To extend this approach:

• make it possible to create or reconfigure a user using this scheme (a cool feature nearly every SAML implementation I use does support, e.g. Nextcloud)
  • if a user does not exist, create it with the given configuration parameters
  • if a user does exist, update the given parameters if required
  • X-GITEA-USERNAME configures username
  • X-GITEA-FULLNAME configures display/full name
  • X-GITEA-MAIL configures mail address