Revise SAML flow, update Okta SAML docs

backend/src/ee/controllers/v1/ssoController.ts

@@ -57,7 +57,6 @@ export const updateSSOConfig = async (req: Request, res: Response) => {
         entryPoint,
         issuer,
         cert,
-        audience
     } = req.body;
 
     const plan = await EELicenseService.getPlan(organizationId);
@@ -78,9 +77,6 @@ export const updateSSOConfig = async (req: Request, res: Response) => {
         encryptedCert?: string;
         certIV?: string;
         certTag?: string;
-        encryptedAudience?: string;
-        audienceIV?: string;
-        audienceTag?: string;
     }
     
     const update: PatchUpdate = {};
@@ -132,18 +128,6 @@ export const updateSSOConfig = async (req: Request, res: Response) => {
         update.certIV = certIV;
         update.certTag = certTag;
     }
-
-    if (audience) {
-        const {
-            ciphertext: encryptedAudience,
-            iv: audienceIV,
-            tag: audienceTag
-        } = client.encryptSymmetric(audience, key);
-        
-        update.encryptedAudience = encryptedAudience;
-        update.audienceIV = audienceIV;
-        update.audienceTag = audienceTag;
-    }
     
     const ssoConfig = await SSOConfig.findOneAndUpdate(
         {
@@ -207,8 +191,7 @@ export const createSSOConfig = async (req: Request, res: Response) => {
         isActive,
         entryPoint,
         issuer,
-        cert,
-        audience
+        cert
     } = req.body;
 
     const plan = await EELicenseService.getPlan(organizationId);
@@ -238,12 +221,6 @@ export const createSSOConfig = async (req: Request, res: Response) => {
         iv: certIV,
         tag: certTag
     } = client.encryptSymmetric(cert, key);
-
-    const {
-        ciphertext: encryptedAudience,
-        iv: audienceIV,
-        tag: audienceTag
-    } = client.encryptSymmetric(audience, key);
     
     const ssoConfig = await new SSOConfig({
         organization: new Types.ObjectId(organizationId),
@@ -257,10 +234,7 @@ export const createSSOConfig = async (req: Request, res: Response) => {
         issuerTag,
         encryptedCert,
         certIV,
-        certTag,
-        encryptedAudience,
-        audienceIV,
-        audienceTag
+        certTag
     }).save();
 
     return res.status(200).send(ssoConfig);

backend/src/ee/helpers/organizations.ts

@@ -51,13 +51,6 @@ export const getSSOConfigHelper = async ({
         ssoConfig.certIV,
         ssoConfig.certTag
     );
-
-    const audience = client.decryptSymmetric(
-        ssoConfig.encryptedAudience,
-        key,
-        ssoConfig.audienceIV,
-        ssoConfig.audienceTag
-    );
     
     return ({
         _id: ssoConfig._id,
@@ -66,7 +59,6 @@ export const getSSOConfigHelper = async ({
         isActive: ssoConfig.isActive,
         entryPoint,
         issuer,
-        cert,
-        audience
+        cert
     });
 }

backend/src/ee/models/ssoConfig.ts

@@ -1,8 +1,12 @@
 import { Schema, Types, model } from "mongoose";
 
+export enum AuthProvider {
+    OKTA_SAML = "okta-saml"
+}
+
 export interface ISSOConfig {
     organization: Types.ObjectId;
-    authProvider: "okta-saml"
+    authProvider: AuthProvider;
     isActive: boolean;
     encryptedEntryPoint: string;
     entryPointIV: string;
@@ -13,9 +17,6 @@ export interface ISSOConfig {
     encryptedCert: string;
     certIV: string;
     certTag: string;
-    encryptedAudience: string;
-    audienceIV: string;
-    audienceTag: string;
 }
 
 const ssoConfigSchema = new Schema<ISSOConfig>(
@@ -26,9 +27,7 @@ const ssoConfigSchema = new Schema<ISSOConfig>(
         },
         authProvider: {
             type: String,
-            enum: [
-                "okta-saml"
-            ],
+            enum: AuthProvider,
             required: true
         },
         isActive: {
@@ -61,15 +60,6 @@ const ssoConfigSchema = new Schema<ISSOConfig>(
         },
         certTag: {
             type: String
-        },
-        encryptedAudience: {
-            type: String
-        },
-        audienceIV: {
-            type: String
-        },
-        audienceTag: {
-            type: String
         }
     },
     {

backend/src/ee/routes/v1/sso.ts

@@ -1,6 +1,9 @@
 import express from "express";
 const router = express.Router();
 import passport from "passport";
+import {
+  AuthProvider
+} from "../../models";
 import {
     requireAuth,
     requireOrganizationAuth,
@@ -87,12 +90,11 @@ router.post(
         locationOrganizationId: "body"
     }),
     body("organizationId").exists().trim(),
-    body("authProvider").exists().isString(),
+    body("authProvider").exists().isString().isIn([AuthProvider.OKTA_SAML]),
     body("isActive").exists().isBoolean(),
     body("entryPoint").exists().isString(),
     body("issuer").exists().isString(),
     body("cert").exists().isString(),
-    body("audience").exists().isString(),
     validateRequest,
     ssoController.createSSOConfig
 );
@@ -113,7 +115,6 @@ router.patch(
     body("entryPoint").optional().isString(),
     body("issuer").optional().isString(),
     body("cert").optional().isString(),
-    body("audience").optional().isString(),
     validateRequest,
     ssoController.updateSSOConfig
 );

backend/src/ee/services/EELicenseService.ts

@@ -66,7 +66,7 @@ class EELicenseService {
         customRateLimits: true,
         customAlerts: true,
         auditLogs: false,
-        samlSSO: false,
+        samlSSO: true,
         status: null,
         trial_end: null,
         has_used_trial: true

backend/src/utils/auth.ts

@@ -147,7 +147,7 @@ const initializePassport = async () => {
           entryPoint: ssoConfig.entryPoint,
           issuer: ssoConfig.issuer,
           cert: ssoConfig.cert,
-          audience: ssoConfig.audience
+          audience: await getSiteURL()
         });
         
         req.ssoConfig = ssoConfig;