SAML Login via e-mail address using mod_mellon and Azure

[Charburner]

Hello everyone, I need help with the correct setup of single sign-on via Azure SAML.

There are customer users in the local database on our Znuny 6 LTS server with a user name like "company_lastname" and a stored e-mail address.
With SAML, it should no longer be possible to log in with the user name, but only with the e-mail address as this is the unique identifier in Azure.

Is it even possible for Znuny to allow a customer user to log in via SAML with their e-mail address + password instead of username + password? If not, this would mean that the user name would have to be changed to the e-mail address for all customer users, right?

So far I have configured the Apache module mod_mellon so that the customer web interface under /customer.pl redirects to Microsoft correctly. If a customer user now tries to log in, a message appears "Authentication succeeded, but no customer record is found in the customer backend. Please contact the administrator."

Otherwise, could this just be a mapping problem?

Thanks in advance

Code: Select all

/etc/httpd/conf.d/auth_mellon.conf

Code: Select all

<Location />
    MellonEnable "info"
    MellonEndpointPath "/mellon"
    MellonSPMetadataFile "/etc/httpd/mellon/mellon_metadata.xml"
    MellonSPPrivateKeyFile /etc/httpd/mellon/mellon.key
    MellonSPCertFile /etc/httpd/mellon/mellon.crt
    MellonIdPMetadataFile /etc/httpd/mellon/idp_metadata.xml
</Location>

<LocationMatch /customer.pl>
    AuthType Mellon
    MellonEnable auth
    Require valid-user

    MellonDecoder "none"
    MellonVariable "cookie"
    MellonSecureCookie On
    MellonUser "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress"
</LocationMatch>

[root]

Hi,

The value of MellonUser (the email address) needs to be the email address. With SAML, no password is required for Znuny; it is only required for the Azure login. Znuny trusts the result of the mod_auth_mellon authentication. Your job is to make sure that the login field of the customer users matches the SAML username.

- Roy

[Charburner]

Thank you, I understand your answer to mean that I actually need to change the username stored in the local Znuny database for all customer users to the associated email address as it is stored in Azure.

As an alternative, is there a "relatively" simple way to customize the Perl code for the CustomerAuth so that the "email" field is compared at database level in the customer_user table instead of the "login" field?

Best regards

[skullz]

maybe check this regex https://github.com/znuny/Znuny/blob/8ad ... s.pm#L1422