fix: Default SAML User Role setting not working with role names

.changeset/metal-moose-travel.md

@@ -0,0 +1,5 @@
+---
+'@rocket.chat/meteor': patch
+---
+
+Fixes a condition where the `SAML_Custom_Default_default_user_role` setting, used to define the default SAML role when none is provided, would fail when a role name was used instead of an ID.

apps/meteor/app/meteor-accounts-saml/server/lib/SAML.ts

@@ -1,7 +1,7 @@
 import type { ServerResponse } from 'http';
 
-import type { IUser, IIncomingMessage, IPersonalAccessToken } from '@rocket.chat/core-typings';
-import { CredentialTokens, Rooms, Users } from '@rocket.chat/models';
+import type { IUser, IIncomingMessage, IPersonalAccessToken, IRole } from '@rocket.chat/core-typings';
+import { CredentialTokens, Rooms, Users, Roles } from '@rocket.chat/models';
 import { Random } from '@rocket.chat/random';
 import { escapeRegExp, escapeHTML } from '@rocket.chat/string-helpers';
 import { Accounts } from 'meteor/accounts-base';
@@ -29,6 +29,20 @@ const showErrorMessage = function (res: ServerResponse, err: string): void {
 	res.end(content, 'utf-8');
 };
 
+const convertRoleNamesToIds = async (roleNamesOrIds: string[]): Promise<IRole['_id'][]> => {
+	const roles = (await Roles.findInIdsOrNames(roleNamesOrIds).toArray()).map((role) => role._id);
+
+	if (roles.length !== roleNamesOrIds.length) {
+		SystemLogger.warn(`Failed to convert some role names to ids: ${roleNamesOrIds.join(', ')}`);
+	}
+
+	if (!roles.length) {
+		throw new Error(`We should have at least one existing role to create the user: ${roleNamesOrIds.join(', ')}`);
+	}
+
+	return roles;
+};
+
 export class SAML {
 	public static async processRequest(
 		req: IIncomingMessage,
@@ -129,7 +143,8 @@ export class SAML {
 
 		if (!user) {
 			// If we received any role from the mapping, use them - otherwise use the default role for creation.
-			const roles = userObject.roles?.length ? userObject.roles : ensureArray<string>(defaultUserRole.split(','));
+			const roleNamesOrIds = userObject.roles?.length ? userObject.roles : ensureArray<string>(defaultUserRole.split(','));
+			const roles = await convertRoleNamesToIds(roleNamesOrIds);
 
 			const newUser: Record<string, any> = {
 				name: fullName,
@@ -200,7 +215,8 @@ export class SAML {
 
 		// When updating an user, we only update the roles if we received them from the mapping
 		if (userObject.roles?.length) {
-			updateData.roles = userObject.roles;
+			const roles = await convertRoleNamesToIds(userObject.roles);
+			updateData.roles = roles;
 		}
 
 		if (userObject.channels && channelsAttributeUpdate === true) {