Saml Source Enrollment and Authentication

[breagan1983]

tl;dr Question: At what authentication stage should someone bind an expression policy to map updated SAML attributes from the IdP? E.g. Group Memberships

Whats working - Enrollment Flow
I have the enrollment flow working with our campus shibboleth based SAML IdP, by binding an expression policy to the default-source-enrollment-prompt stage to map the attributes to the Authentik User model...

request.context["flow_plan"].context["email"] = request.context["prompt_data"]["urn:oid:1.3.6.1.4.1.5923.1.1.1.6"]
request.context["flow_plan"].context["username"] = request.context["prompt_data"]["urn:oid:0.9.2342.19200300.100.1.1"]
request.context["flow_plan"].context["name"] = request.context["prompt_data"]["urn:oid:0.9.2342.19200300.100.1.1"]
return True

I was able to work through this by enabling Execution logging on an expression policy I called logger-policy that just returns true, and figuring out where the message data from the SAML response was being stored at the time.

What I can't figure out - Authentication Flow
What I'm struggling with is at what point in the Authentication flow is it processing the SAML source message from the IdP when it determines the user already exists.

I used the same logger-policy as a pre-flow policy, both before and after the default-source-authentication-if-sso policy, as was bound policies before and after the default-source-authentication-login stage. I can't find it now, but I recall some where in the overall logic to check authentik_core:if-user... is it possible, and is that where, an expression policy should be bound to upsert any SAML attibs?

Many thanks,
-Bryan

P.S.> To all the authors and contributors to this project, to use brevity for emphasis... thank you. We're trying to sell our leadership time on using Authentik as a foundational service to our internal and external facing tools, and having the on-prem free open-source version has been critical to getting a MVP online and cost-justify the enterprise licensing down the road.

[LM1LC3N7]

Hi @breagan1983

I currently have difficulties also with an external SAML source.

When a user is authenticated using the external SSO source, then Authentik generate an error instead of importing the user to the local database.
It might depend on the user matching mode field, but no option is saying explicitely users will be imported.
--> how to do this part ?

I did not found useful documentation about the external SAML response fields Authentik is looking for.
And as I am new to Authentik, I don't understand yet how to debug the default enrollment flow.