SAML is only half implemented

[ptman]

@ara4n:

synapse/synapse/config/saml2_config.py

Line 68 in 35442ef

# Enable SAML2 for registration and login. Uses pysaml2.

@richvdh: "saml is only half implemented"
"only works with a custom proxy to prepare the saml query"

[localguru]

What exactly means "only works with a custom proxy to prepare the saml query". Any further documentation on that?

[ptman]

Which clients can be used for SAML auth? element-hq/element-web#3544

[richvdh]

once saml support in synapse is completed, any client that supports the m.login.sso flow, or fallback auth will support saml.

The part that is missing is step 2 of https://matrix.org/docs/spec/client_server/unstable.html#sso-client-login: Synapse needs to handle the /login/sso/redirect endpoint and 302 to the SAML interface.

[menturion]

Is there already a date on which SAML will probably be fully implemented?

[richvdh]

This was fixed by #5422

[slipeer]

Some SAML2 related stuff still unimplemented. Such as:

• SAML logout
• UPDATE user's displayname from SAML IdP (on_successfil_auth update it only at registration phase)
• Documenting how make it work. For example only displayname attribute used from SAML Authn Responce and it isn't referenced in documentation. To make it work with Ad FS, I needed to set up additional AD FS rules - it wasn't trivial to deal with this.

[ara4n]

@slipeer do you have doc for how you got it to work with AD?