chore(saml): redirect to login page on fail (#8247)

api/src/backend/api/tests/test_views.py

@@ -5978,7 +5978,8 @@ class TestSAMLConfigurationViewSet:
 
 @pytest.mark.django_db
 class TestTenantFinishACSView:
-    def test_dispatch_skips_if_user_not_authenticated(self):
+    def test_dispatch_skips_if_user_not_authenticated(self, monkeypatch):
+        monkeypatch.setenv("AUTH_URL", "http://localhost")
         request = RequestFactory().get(
             reverse("saml_finish_acs", kwargs={"organization_slug": "testtenant"})
         )
@@ -5999,7 +6000,8 @@ class TestTenantFinishACSView:
 
         assert response.status_code in [200, 302]
 
-    def test_dispatch_skips_if_social_app_not_found(self, users_fixture):
+    def test_dispatch_skips_if_social_app_not_found(self, users_fixture, monkeypatch):
+        monkeypatch.setenv("AUTH_URL", "http://localhost")
         request = RequestFactory().get(
             reverse("saml_finish_acs", kwargs={"organization_slug": "testtenant"})
         )
@@ -6037,7 +6039,7 @@ class TestTenantFinishACSView:
                 "firstName": ["John"],
                 "lastName": ["Doe"],
                 "organization": ["testing_company"],
-                "userType": ["saml_default_role"],
+                "userType": ["no_permissions"],
             },
         )
 
@@ -6091,7 +6093,7 @@ class TestTenantFinishACSView:
         assert user.name == "John Doe"
         assert user.company_name == "testing_company"
 
-        role = Role.objects.using(MainRouter.admin_db).get(name="saml_default_role")
+        role = Role.objects.using(MainRouter.admin_db).get(name="no_permissions")
         assert role.tenant == tenants_fixture[0]
 
         assert (

api/src/backend/api/v1/views.py

@@ -560,10 +560,11 @@ class SAMLConfigurationViewSet(BaseRLSViewSet):
 
 class TenantFinishACSView(FinishACSView):
     def dispatch(self, request, organization_slug):
-        response = super().dispatch(request, organization_slug)
+        super().dispatch(request, organization_slug)
         user = getattr(request, "user", None)
         if not user or not user.is_authenticated:
-            return response
+            callback_url = env.str("AUTH_URL")
+            return redirect(f"{callback_url}?sso_saml_failed=true")
 
         # Defensive check to avoid edge case failures due to inconsistent or incomplete data in the database
         # This handles scenarios like partially deleted or missing related objects
@@ -585,7 +586,8 @@ class TenantFinishACSView(FinishACSView):
             SocialAccount.DoesNotExist,
             User.DoesNotExist,
         ):
-            return response
+            callback_url = env.str("AUTH_URL")
+            return redirect(f"{callback_url}?sso_saml_failed=true")
 
         extra = social_account.extra_data
         user.first_name = (
@@ -607,9 +609,9 @@ class TenantFinishACSView(FinishACSView):
             .tenant
         )
         role_name = (
-            extra.get("userType", ["saml_default_role"])[0].strip()
+            extra.get("userType", ["no_permissions"])[0].strip()
             if extra.get("userType")
-            else "saml_default_role"
+            else "no_permissions"
         )
         try:
             role = Role.objects.using(MainRouter.admin_db).get(