Implementing SSO #230

kevin-atnos · 2023-10-17T11:21:35Z

This pull request introduces significant updates to the application, focusing on adding SAML-based single sign-on (SSO) support, improving database query performance, and enhancing configuration and session management. Below is a summary of the most important changes grouped by theme.

SAML-Based Single Sign-On (SSO) Integration:

Added SamlController to handle SAML metadata, SSO, logout, and SLO responses, enabling SAML-based authentication workflows (app/controllers/saml_controller.rb).
Configured SAML-related routes for metadata, SSO, logout, and assertion consumer services in config/routes.rb.
Updated devise initializer with commented-out SAML configuration options to support SAML-based user authentication (config/initializers/devise.rb).

Performance Improvements:

Modified Pia and PiaPolicy queries to use eager_load for preloading associated user_pias, reducing N+1 query issues (app/controllers/pias_controller.rb, app/policies/pia_policy.rb) [1] [2].

Session and Configuration Enhancements:

Configured Redis as the session store and enabled session management middleware for better scalability and performance (config/initializers/session_store.rb).
Added config.secret_key_base to config/application.rb for secure application configuration (config/application.rb).

Dependency Updates:

Added new gems: ruby-saml and devise_saml_authenticatable for SAML authentication, and redis with redis-actionpack for Redis-based session storage (Gemfile).

Minor Code and Syntax Improvements:

Updated syntax for hash shorthand and string quoting in various files for consistency (app/models/user.rb, config/application.rb) [1] [2].

app/controllers/saml_controller.rb

+        user.unlock_access!
+      else
+        password = [*'0'..'9', *'a'..'z', *'A'..'Z', *'!'..'?'].sample(16).join
+        user = User.create!(email:, password:, password_confirmation: password)


To fix the issue, we need to ensure that the password is hashed before being stored in the database. Rails provides built-in support for securely hashing passwords using the has_secure_password method in the User model, which relies on bcrypt. This method automatically hashes the password when it is assigned to the password attribute.

The fix involves:

Ensuring the User model uses has_secure_password (this is assumed to be already implemented since password and password_confirmation are used).

Modifying the consume method to assign the plain-text password to the password attribute, allowing Rails to handle the hashing automatically.

app/controllers/saml_controller.rb

+        user.unlock_access!
+      else
+        password = [*'0'..'9', *'a'..'z', *'A'..'Z', *'!'..'?'].sample(16).join
+        user = User.create!(email:, password:, password_confirmation: password)


To fix the issue, the password should be hashed before being stored in the database. In Rails, this is typically handled by the has_secure_password method provided by the bcrypt gem. This method automatically hashes passwords when they are assigned to the password attribute of a model. The User model should already be configured to use has_secure_password for this fix to work. If it is not, additional changes to the User model will be required.

The fix involves replacing the direct assignment of the password and password_confirmation attributes with a single assignment to the password attribute. This ensures that the password is hashed before being stored.

kevin-atnos · 2024-01-24T16:08:40Z

Note : il faudra rebase cette branche quand Add Rubocop, brakeman, bundler-audit #236 aura été mergé.

Copilot

Pull Request Overview

This PR implements Single Sign-On (SSO) functionality by adding new SAML routes and controllers, updating session management with Redis, and configuring SAML settings in Devise.

Added SAML routes in routes.rb
Introduced a new SamlController that handles SSO, ACS, and SLO flows
Updated session store and extended Devise initializer with commented SAML config for future adjustments

Reviewed Changes

Copilot reviewed 11 out of 11 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
config/routes.rb	Added SAML endpoints for metadata, SSO, ACS, logout, and SLO handling
config/initializers/session_store.rb	Configured Redis as the session store with updated parameters
config/initializers/devise.rb	Enabled email authentication and provided commented sample SAML settings
config/application.rb	Minor changes with stylistic quote updates and added secret_key_base
app/policies/pia_policy.rb	Switched to eager loading of associated records for performance improvements
app/models/user.rb	Updated login uniqueness validation using Ruby shorthand, but with issues
app/controllers/saml_controller.rb	Introduced new controller handling SSO requests and SAML attribute population
app/controllers/pias_controller.rb	Adjusted association loading for performance
app/controllers/application_controller.rb	Extended info API to include SSO enabled flag
Gemfile	Added new dependencies for ruby-saml, devise_saml_authenticatable, and Redis

app/models/user.rb

mrdev023 · 2025-11-25T14:48:49Z

config/application.rb

    attributes_allowed = ENV['SANITIZED_ALLOWED_ATTRIBUTES'] ? ENV['SANITIZED_ALLOWED_ATTRIBUTES'].split(' ') : []
    config.action_view.sanitized_allowed_attributes = attributes_allowed
+
+    config.secret_key_base = Rails.application.credentials.secret_key_base


@kevin-atnos The changes in application.rb is useless because Ruby on Rails already try to load from ENV and then from credentials the secret_key_base.

Source

@brunto I think it's better to let the choice to the sys administrator how to deploy it.

# Conflicts: # Gemfile.lock # config/environments/development.rb

github-advanced-security bot found potential problems Oct 17, 2023

View reviewed changes

app/controllers/saml_controller.rb Fixed Show fixed Hide fixed

app/controllers/saml_controller.rb Fixed Show fixed Hide fixed

github-advanced-security bot found potential problems Nov 14, 2023

View reviewed changes

app/controllers/saml_controller.rb Fixed Show fixed Hide fixed

app/controllers/saml_controller.rb Fixed Show fixed Hide fixed

github-advanced-security bot found potential problems Nov 14, 2023

View reviewed changes

kevin-atnos assigned brunto, kevin-atnos, syl-p and LaboCNIL and unassigned brunto, kevin-atnos and syl-p Jan 31, 2024

kevin-atnos added the IN REVIEW (CNIL) label Jan 31, 2024

kevin-atnos force-pushed the sso branch from 902f302 to 8abe32e Compare November 29, 2024 13:46

brunto changed the base branch from master to rails_8.0 May 12, 2025 14:53

brunto changed the base branch from rails_8.0 to master May 19, 2025 20:38

brunto requested review from brunto and Copilot May 19, 2025 20:44

Copilot AI reviewed May 19, 2025

View reviewed changes

app/models/user.rb Show resolved Hide resolved

brunto previously approved these changes Jul 18, 2025

View reviewed changes

brunto dismissed their stale review via a961377 October 30, 2025 08:50

mrdev023 reviewed Nov 25, 2025

View reviewed changes

kevin-atnos and others added 9 commits December 15, 2025 16:45

Implementing SSO

bcc624e

# Conflicts: # Gemfile.lock # config/environments/development.rb

Add redis session store

8530717

fix queries N+1

964a3e5

Update saml_controller.rb

1b9b421

Add missing allow host and unlock_access

e29ac01

Missing condition

b564c6d

Update README.md

e0953af

Update README.md

61c1218

fix: README

fc1bc38

brunto force-pushed the sso branch from a548529 to b33d579 Compare December 15, 2025 15:53

fix: update SSO redirection to use environment variable

7794e6a

brunto force-pushed the sso branch from c45b3e0 to 7794e6a Compare January 16, 2026 08:35

Add IdP certificate fingerprint settings (#346)

2014fde

@@ -24,3 +24,3 @@
                     password = SecureRandom.hex(16)
-                    user = User.create!(email:, password:, password_confirmation: password)
+                    user = User.create!(email:, password:)
                     user.is_user = true

@@ -24,3 +24,3 @@
                     password = SecureRandom.hex(16)
-                    user = User.create!(email:, password:, password_confirmation: password)
+                    user = User.create!(email:, password:)
                     user.is_user = true

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Implementing SSO #230

Implementing SSO #230

Uh oh!

kevin-atnos commented Oct 17, 2023 •

edited by brunto

Loading

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Check failure

Copilot Autofix

Check failure

Copilot Autofix

kevin-atnos commented Jan 24, 2024 •

edited by brunto

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

mrdev023 Nov 25, 2025 •

edited

Loading

Uh oh!

mrdev023 Jan 13, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

Implementing SSO #230

Are you sure you want to change the base?

Implementing SSO #230

Uh oh!

Conversation

kevin-atnos commented Oct 17, 2023 • edited by brunto Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

SAML-Based Single Sign-On (SSO) Integration:

Performance Improvements:

Session and Configuration Enhancements:

Dependency Updates:

Minor Code and Syntax Improvements:

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Check failure

Copilot Autofix

Check failure

Copilot Autofix

kevin-atnos commented Jan 24, 2024 • edited by brunto Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Uh oh!

mrdev023 Nov 25, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

mrdev023 Jan 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

kevin-atnos commented Oct 17, 2023 •

edited by brunto

Loading

kevin-atnos commented Jan 24, 2024 •

edited by brunto

Loading

mrdev023 Nov 25, 2025 •

edited

Loading

mrdev023 Jan 13, 2026 •

edited

Loading