Okta SAML integration and Group mapping

[dvdoron]

Please confirm the following

• I agree to follow this project's code of conduct.
• I have checked the current issues for duplicates.
• I understand that AWX is open source software provided for free and that I might not receive a timely response.
• I am NOT reporting a (potential) security vulnerability. (These should be emailed to [email protected] instead.)

Bug Summary

We are trying to migrate off LDAP in favor of Okta SAML.

While we are testing the integration with Okta, we are encountering many issues with existing users trying to log in with Okta for the first time.
This results with users losing permissions and new AWX teams being created based on the users' Okta groups' names.

Which floods AWX with non-used AWX teams.

AWX version

AWX 24.6.1

Select the relevant components

• UI
• UI (tech preview)
• API
• Docs
• Collection
• CLI
• Other

Installation method

kubernetes

Modifications

no

Ansible version

AWX 24.6.1

Operating system

No response

Web browser

Chrome

Steps to reproduce

1. Setup Okta SAML integration.

2. Setup the saml team map based on the okta group and AWX teams.

3. Give a specific team execute permission (use one of the team the is setup in the mapping)

4. try login through Okta and verify you have ability to execute job template.

Expected results

I expect to see the user's permissions granted based on the existing AWX teams and the user assigned to the correct AWX team.

Actual results

New teams are being created based on the Okta group name.
Users are not assigned to existing AWX teams with the permissions assigned to the team.

This results the users losing their permissions when they try to log in for the first time from Okta and not with LDAP.

Additional information

In LDAP, it is possible to take an LDAP CN of LDAP Group and map it to an exisiting AWX Team, and is working perfectly and no issues there.

When it comes to the SAML, I do see the main issue.

AWX is expecting to get 2 different saml attributes:

One for the members and one for the admins as described here (https://github.com/ansible/awx/blob/devel/docs/auth/saml.md#example-saml-organization-attribute-mapping)

<saml2:AttributeStatement>
    <saml2:Attribute FriendlyName="member-of" Name="member-of" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified">
   	 <saml2:AttributeValue>Engineering</saml2:AttributeValue>
   	 <saml2:AttributeValue>IT</saml2:AttributeValue>
   	 <saml2:AttributeValue>HR</saml2:AttributeValue>
   	 <saml2:AttributeValue>Sales</saml2:AttributeValue>
    </saml2:Attribute>
    <saml2:Attribute FriendlyName="administrator-of" Name="administrator-of" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified">
   	 <saml2:AttributeValue>IT</saml2:AttributeValue>
   	 <saml2:AttributeValue>HR</saml2:AttributeValue>
    </saml2:Attribute>
</saml2:AttributeStatement>

The problem is that Okta works differently. Okta sends one attribute called "Groups" in the saml response and lists all of the Okta Groups a user is assigned to.

            <saml2:Attribute Name="Groups"
                             NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified"
                             >
                <saml2:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema"
                                      xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
                                      xsi:type="xs:string"
                                      >GroupA</saml2:AttributeValue>
                <saml2:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema"
                                      xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
                                      xsi:type="xs:string"
                                      >GroupB</saml2:AttributeValue>
                <saml2:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema"
                                      xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
                                      xsi:type="xs:string"
                                      >GroupC</saml2:AttributeValue>
                <saml2:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema"
                                      xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
                                      xsi:type="xs:string"
                                      >GroupD</saml2:AttributeValue>
            </saml2:Attribute>

There is no way to list "admin-of" groups because in Okta, even though you're an admin of an Okta group, it will not list it as an admin of a group.

Comparing how LDAP works, you can specify the LDAP groups to be mapped into existing AWX teams, and it works perfectly. However, in Saml, it works differently for some reason, messing up our current user and teams assigning.