[BUG] Wiki.JS Missing or invalid email address from profile

[jasonrappaport]

Trying to configure SAML auth within Wiki.JS, Wiki.JS will redirect to Shibboleth IDP correctly, IDP will process authentication, but when IDP posts back to Wiki.JS an error is presented, "Missing or invalid email address from profile"

Wiki.JS is configured to use the following as nameID format:
urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress

Within the SAML request is indeed the nameID format:
<samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
ID="_77f3afd725f3c00bc4e9"
Version="2.0"
IssueInstant="2021-01-22T19:31:41.229Z"
ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
Destination="https://IDP/idp/profile/SAML2/Redirect/SSO"
AssertionConsumerServiceURL="https://wiki.js/login/8c245895-a6e5-4fbb-988d-ba8dd98c2f68/callback"
ProviderName="wiki-js"
>
<saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">wiki-js</saml:Issuer>
<samlp:NameIDPolicy xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
AllowCreate="true"
/>
</samlp:AuthnRequest>

Within the SAML response, in the SAML subject, is indeed a nameID in the specified format:
<saml2:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
NameQualifier="https://idp/idp/shibboleth"
SPNameQualifier="wiki-js"
>[email protected]</saml2:NameID>

No errors are present within the IDP as authentication is indeed working and the IDP is sending a valid SAML response to the service provider.

Within Wiki.JS I have enabled just in time provisioning as well as pre-staged the account.

Suggestions are welcome.

[markstos]

No evidence is provided here that there's a bug in passport-saml, which works fine with the popular urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress format. If there's a bug, you should be able to write a test for the test suite which fails.

Sorry, there aren't developer resources here to provide support. If you able to reproduce the issue with a failing test suite test, please contribute that in a PR.

[taksan]

@jasonrappaport

I know this issues is closed as it should be, but I would like to contribute with a solution. In fact, the problem isn't related with passport-saml, but with xwikjs saml + google workspace configuration.

I had to debug wikijs to figure out the issue. To make this work:

1. On the IDP you must map the email address to a field (for example, emailAddress)
2. On WikiJS, go to the SAML authentication configuration, on the input for "Email field mapping" enter the same field name, "emailAddress"

That should do it.

[deeepakkumarthakur16]

@taksan Thanks for your solution. It fixed long pending issue for me.