snapshot of https://github.com/RocketChat/Rocket.Chat.git (develop, 2026-09-16; blobs > 131072B omitted)

apps/meteor/ee/server/configuration/saml.ts

@@ -0,0 +1,73 @@
+import { License } from '@rocket.chat/license';
+import { Roles, Users } from '@rocket.chat/models';
+
+import { ensureArray } from '../../../lib/utils/arrayUtils';
+import type { ISAMLUser } from '../../../server/lib/saml/definition/ISAMLUser';
+import { SAMLUtils } from '../../../server/lib/saml/lib/Utils';
+import { settings } from '../../../server/settings';
+import { addSettings } from '../settings/saml';
+
+await License.onLicense('saml-enterprise', () => {
+	SAMLUtils.events.on('mapUser', async ({ profile, userObject }: { profile: Record<string, any>; userObject: ISAMLUser }) => {
+		const roleAttributeName = settings.get('SAML_Custom_Default_role_attribute_name') as string;
+		const roleAttributeSync = settings.get('SAML_Custom_Default_role_attribute_sync');
+
+		if (!roleAttributeSync) {
+			return;
+		}
+
+		if (roleAttributeName && profile[roleAttributeName]) {
+			let value = profile[roleAttributeName] || '';
+			if (typeof value === 'string') {
+				value = value.split(',');
+			}
+
+			const savedRoles = await Roles.findInIdsOrNames(ensureArray<string>(value)).toArray();
+
+			userObject.roles = savedRoles.map((role) => role._id);
+		}
+	});
+
+	SAMLUtils.events.on('loadConfigs', (service: string, configs: Record<string, any>): void => {
+		// Include ee settings on the configs object so that they can be copied to the login service too
+		const rawCustomAuthnContext = settings.get(`${service}_custom_authn_context`);
+		const customAuthnContext = typeof rawCustomAuthnContext === 'string' ? rawCustomAuthnContext.trim() : undefined;
+
+		Object.assign(configs, {
+			...(customAuthnContext !== undefined && { customAuthnContext }),
+			authnContextComparison: settings.get(`${service}_authn_context_comparison`),
+			identifierFormat: settings.get(`${service}_identifier_format`),
+			nameIDPolicyTemplate: settings.get(`${service}_NameId_template`),
+			authnContextTemplate: settings.get(`${service}_AuthnContext_template`),
+			authRequestTemplate: settings.get(`${service}_AuthRequest_template`),
+			logoutResponseTemplate: settings.get(`${service}_LogoutResponse_template`),
+			logoutRequestTemplate: settings.get(`${service}_LogoutRequest_template`),
+			metadataCertificateTemplate: settings.get(`${service}_MetadataCertificate_template`),
+			metadataTemplate: settings.get(`${service}_Metadata_template`),
+		});
+	});
+
+	SAMLUtils.events.on('updateCustomFields', async (loginResult: Record<string, any>, updatedUser: { userId: string; token: string }) => {
+		const userDataCustomFieldMap = settings.get('SAML_Custom_Default_user_data_custom_fieldmap') as string;
+		const customMap: Record<string, any> = JSON.parse(userDataCustomFieldMap);
+
+		const customFieldsList: Record<string, any> = {};
+
+		for (const spCustomFieldName in customMap) {
+			if (!customMap.hasOwnProperty(spCustomFieldName)) {
+				continue;
+			}
+
+			const customAttribute = customMap[spCustomFieldName];
+			const value = SAMLUtils.getProfileValue(loginResult.profile, {
+				fieldName: spCustomFieldName,
+			});
+			customFieldsList[customAttribute] = value;
+		}
+
+		await Users.updateCustomFieldsById(updatedUser.userId, customFieldsList);
+	});
+});
+
+// For setting creation we add the listener first because the event is emmited during startup
+SAMLUtils.events.on('addSettings', (name: string): void | Promise<void> => License.onLicense('saml-enterprise', () => addSettings(name)));