fix(saml): restore SAML, deactivate urls, enable idp-initiate (#8175)

api/src/backend/config/settings/social_login.py

@@ -25,9 +25,18 @@ SOCIALACCOUNT_EMAIL_AUTHENTICATION = True
 SOCIALACCOUNT_EMAIL_AUTHENTICATION_AUTO_CONNECT = True
 SOCIALACCOUNT_ADAPTER = "api.adapters.ProwlerSocialAccountAdapter"
 
-# SAML keys (TODO: Validate certificates)
-# SAML_PUBLIC_CERT = env("SAML_PUBLIC_CERT", default="")
-# SAML_PRIVATE_KEY = env("SAML_PRIVATE_KEY", default="")
+
+# def inline(pem: str) -> str:
+#     return "".join(
+#         line.strip()
+#         for line in pem.splitlines()
+#         if "CERTIFICATE" not in line and "KEY" not in line
+#     )
+
+
+# # SAML keys (TODO: Validate certificates)
+# SAML_PUBLIC_CERT = inline(env("SAML_PUBLIC_CERT", default=""))
+# SAML_PRIVATE_KEY = inline(env("SAML_PRIVATE_KEY", default=""))
 
 SOCIALACCOUNT_PROVIDERS = {
     "google": {
@@ -60,17 +69,14 @@ SOCIALACCOUNT_PROVIDERS = {
             "entity_id": "urn:prowler.com:sp",
         },
         "advanced": {
+            # TODO: Validate certificates
             # "x509cert": SAML_PUBLIC_CERT,
             # "private_key": SAML_PRIVATE_KEY,
             # "authn_request_signed": True,
-            # "want_assertion_signed": True,
             # "want_message_signed": True,
+            # "want_assertion_signed": True,
+            "reject_idp_initiated_sso": False,
             "name_id_format": "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress",
-            "authn_request_signed": False,
-            "logout_request_signed": False,
-            "logout_response_signed": False,
-            "want_assertion_encrypted": False,
-            "want_name_id_encrypted": False,
         },
     },
 }