snapshot of https://github.com/mattermost/mattermost.git (master, 2026-09-16; blobs > 131072B omitted)

e2e-tests/playwright/specs/functional/system_console/saml/saml_login.spec.ts

@@ -0,0 +1,59 @@
+// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved.
+// See LICENSE.txt for license information.
+
+import {expect, test, getRandomId} from '@mattermost/playwright-lib';
+
+/**
+ * @objective Verify a user who only exists in Keycloak (never created in Mattermost) can
+ * authenticate through SAML SSO once SAML authentication is enabled, and that the server
+ * provisions their account via SAML on first login rather than local auth.
+ *
+ * @precondition
+ * A Keycloak realm reachable at the configured SamlSettings.IdpURL, with a SAML client matching
+ * ServiceProviderIdentifier.
+ */
+test('logs in a directory-only user through Keycloak SAML SSO', {tag: '@saml'}, async ({pw}) => {
+    // Ensure prerequisites
+    await pw.ensureLicense();
+    await pw.skipIfNoLicense();
+    await pw.ensureKeycloak();
+
+    const {adminClient} = await pw.getAdminClient();
+
+    const randomId = getRandomId();
+    const keycloakUser = {
+        username: `samluser${randomId}`,
+        email: `samluser${randomId}@mmtest.com`,
+        firstName: `Firstname-${randomId}`,
+        lastName: `Lastname-${randomId}`,
+        password: 'Password1',
+    };
+
+    const keycloakUserId = await pw.createKeycloakUser(keycloakUser);
+
+    try {
+        // # Log in through the SAML SSO button, which redirects to Keycloak's hosted login form
+        await pw.hasSeenLandingPage();
+        await pw.loginPage.goto();
+        await pw.loginPage.toBeVisible();
+
+        // * Verify the login form reflects SAML being enabled
+        await expect(pw.loginPage.samlLoginButton).toBeVisible();
+        await pw.loginPage.samlLoginButton.click();
+
+        // Keycloak's own hosted login form.
+        await pw.loginPage.page.locator('#username').fill(keycloakUser.username);
+        await pw.loginPage.page.locator('#password').fill(keycloakUser.password);
+        await pw.loginPage.page.locator('#kc-login').click();
+
+        // * Verify the login succeeded
+        await expect(pw.loginPage.page).not.toHaveURL(/\/login/);
+
+        // * Verify the server provisioned the account via SAML, with Keycloak's attributes
+        const provisionedUser = await adminClient.getUserByUsername(keycloakUser.username);
+        expect(provisionedUser.auth_service).toBe('saml');
+        expect(provisionedUser.email).toBe(keycloakUser.email);
+    } finally {
+        await pw.deleteKeycloakUser(keycloakUserId);
+    }
+});