SAML Support

public/index.js

@@ -34,24 +34,39 @@ module.exports = function(currentUser, matchingUsers, params, token) {
       window.location = domain + 'authorize?' + query;
     };
 
+    var authorizeSaml = function(domain, qs) {
+      let clientId = qs["client_id"];
+      let connection = encodeURIComponent(qs["connection"]);
+      let link_account_token = encodeURIComponent(qs["link_account_token"]);
+      window.location = domain + `samlp/${clientId}?connection=${connection}&link_account_token=${link_account_token}&prevent_sign_up=true`;
+    };
+
     var updateContinueUrl = function(linkEl, domain, state) {
       linkEl.href = domain + 'continue?state=' + state;
     };
 
     linkEl.addEventListener('click', function(e) {
-      authorize(token.iss, {
-        client_id: params.client_id,
-        redirect_uri: params.redirect_uri,
-        response_type: params.response_type,
-        response_mode: params.response_mode,
-        scope: params.scope,
-        state: params.original_state,
-        nonce: params.nonce,
-        audience: params.audience,
-        link_account_token: params.child_token,
-        prevent_sign_up: true,
-        connection: connections[0]
-      });
+      if (params.protocol === 'samlp') {
+        authorizeSaml(token.iss, {
+          client_id: params.client_id,
+          connection: connections[0],
+          link_account_token: params.child_token
+        });
+      } else {
+        authorize(token.iss, {
+          client_id: params.client_id,
+          redirect_uri: params.redirect_uri,
+          response_type: params.response_type,
+          response_mode: params.response_mode,
+          scope: params.scope,
+          state: params.original_state,
+          nonce: params.nonce,
+          audience: params.audience,
+          link_account_token: params.child_token,
+          prevent_sign_up: true,
+          connection: connections[0]
+        });
+      }
     });
 
     updateContinueUrl(skipEl, token.iss, params.state);
@@ -123,4 +138,4 @@ module.exports = function(currentUser, matchingUsers, params, token) {
 
     return keys;
   }
-}
+}

rules/link.js

@@ -211,9 +211,10 @@ module.exports = ({ extensionURL = '', username = 'Unknown', clientID = '', clie
   // Consider moving this logic out of the rule and into the extension
   function buildRedirectUrl(token, q, errorType) {
     var params = {
+      protocol: context.protocol,
       child_token: token,
       audience: q.audience,
-      client_id: q.client_id,
+      client_id: q.client_id ? q.client_id : context.clientID,
       redirect_uri: q.redirect_uri,
       scope: q.scope,
       response_type: q.response_type,