Wrong user when logging using SAML with RocketChat 1.1.0

[menardorama]

Description:

Updated rocketchat to 1.1.0 on my on prem rocketchat server and now when users log in using SAML are not matchedon the right user in rocketchat

Steps to reproduce:

1. Setup SAML using rocketchat 1.0.3
2. Login
3. Logout
4. Update to 1.1.0
5. Login

Expected behavior:

Should work like before

Actual behavior:

User are being matched to somebody else.

SAML Debug log show the right user but it's next mapped to another user

Server Setup Information:

• Version of Rocket.Chat Server: 1.1.0
• Operating System: Kubernetes using mongo replicaset
• Deployment Method: kubernetes
• Number of Running Instances: 10
• DB Replicaset Oplog: 3
• MongoDB Version: 4.0.6

[julienvey]

We see the exact same behaviour on our RocketInstance.

The user being matched seems to be always the same one

Our setup is almost the same than @menardorama

We had to deactivate SAML for now to avoid any problem

Server Setup Information:

Version of Rocket.Chat Server: 1.1.0
Operating System: Kubernetes using mongo replicaset
Deployment Method: kubernetes
Number of Running Instances: 3
DB Replicaset Oplog: 3
MongoDB Version: 3.6.9

[menardorama]

I don't know if I did well, but as I only use SAML and of course I didn't do a mongo backup before the update (which is bad......) so I found a workaround which works for me this time.

I was able to rollback to 1.0.3 by updating the version in the rocketchat db.

I was lucky, the last migration did only have an update on the Livechat secret https://github.com/RocketChat/Rocket.Chat/blob/1.1.0/server/startup/migrations/v145.js

So I have updated to version 144 in the db and start again version 1.0.3
Step to rollback :

1. Stop Rocketchat
2. Update the migration table to set to version 144
3. Start Rocketchat version 1.0.3

[joulaud]

I have no way of testing this hypothesis but I suspect bad regexp handling on email addresses matching. The regexp in question is probably https://github.com/RocketChat/Rocket.Chat/blob/develop/app/meteor-accounts-saml/server/saml_server.js#L116

Also the findOne on L134 seems brittle to me unless we can strongly guarantee that there is never two profiles sharing one email.

[joulaud]

I was plain wrong, the problem is not with the regexp (which did not change) but with filtering on eduPersonPrincipalName.

Which leads when this field is not set anywhere to

rs0:PRIMARY> db.users.find({"eppn": null}).count() == db.users.find().count() 
true