Error after SAML authentication

[BcTpe4HbIu]

Description:

Server Setup Information:

• Version of Rocket.Chat Server: 0.63.3
• Operating System: CentOS 7
• Deployment Method(snap/docker/tar/etc): docker
• Number of Running Instances: 1
• DB Replicaset Oplog: No
• Node Version: 8.9.3 - x64
• mongoDB Version: 3.6

Steps to Reproduce:

1. Configure SAML with ADFS 2012
2. Try to login
3. Get error in popup: TypeError: Cannot read property 'toString' of undefined

Expected behavior:

Login to server

Actual behavior:

Error reported

Relevant logs:

No errors logs in browser or server log.

[BcTpe4HbIu]

Problem is that search for signature tag returning nothing, because whole assertion is encrypted.

So now the question is encrypted assertion supported?

[BcTpe4HbIu]

@Bill81710 (from #2770) is your saml response encrypted?

[BcTpe4HbIu]

Anyway, solved for me by removing public/private key from saml settings. This disabled encryption on ADSF side and auth worked.

Probably this must be documented somewhere?

[Hudell]

Can you check if it's working on the current version of Rocket.Chat?

[BcTpe4HbIu]

What exactly should work with current version? Encrypted assertion is now supported?

[BcTpe4HbIu]

Added certs for SAML. Will check it tomorrow.

[BcTpe4HbIu]

Same error with 0.68.5

Sorry, an annoying error occured
TypeError: Cannot read property 'toString' of undefined
Close Window

[zopanix]

@BcTpe4HbIu : I'm hitting the same error, can you explain your workaround ? Did get the part of removing public and private key

[BcTpe4HbIu]

@zopanix The problem is "encrypted assertion". If your authentication party sends it in reply - Rocket.Chat will fail to process it. So workaround is to ensure reply is not encrypted. ADFS, for example, will automaticly encrypt reply if public key is present in service metadata. So if you clean fields private key and public cert in saml settings ADFS will reply without encryption.

[zopanix]

@BcTpe4HbIu : thx, was not sure I understodd it correctly.

[theorenck]

@Hudell can you take look again in this one, please?

[pierre-lehnen-rc]

This one was fixed by #12153