From 657f90ef137ee152cf58e7748e62c6a98a9540fe Mon Sep 17 00:00:00 2001
From: Ersei Saggi <vcs@ersei.net>
Date: Sun, 6 Aug 2023 16:19:53 -0400
Subject: [PATCH] fix: make SAML paths better; improve and add OID discovery
 defaults

---
 README.md                              |  4 ++-
 SSO-Auth/Api/SSOController.cs          |  9 ++---
 SSO-Auth/Config/PluginConfiguration.cs | 12 ++++++-
 SSO-Auth/Config/configPage.html        | 48 ++++++++++++++++++++++++--
 4 files changed, 65 insertions(+), 8 deletions(-)

diff --git a/README.md b/README.md
index 8defbe7..872d4df 100644
--- a/README.md
+++ b/README.md
@@ -236,7 +236,9 @@ These all require authorization. Append an API key to the end of the request: `c
     - Leave empty to only request the default scopes.
   - `defaultProvider`: string. The set provider then gets assigned to the user after they have logged in. If it is not set, nothing is changed. With this, a user can login with SSO but is still able to log in via other providers later. See the `Unregister` endpoint.
   - `defaultUsernameClaim`: string. The provider will use the claim to create the users' usernames. If not set, it fallbacks to `preferred_username`.
-  - `requireHttps`: boolean. Determines whether the OpenID discovery endpoint requires HTTP. It is advised NOT to set this to false. If not set, it fallbacks to `true`.
+  - `disableHttps`: boolean. Determines whether the OpenID discovery endpoint requires HTTPS.
+  - `doNotValidateEndpoints`: boolean. Determines whether the OpenID discovery process will validate endpoints. This may be required for Google.
+  - `doNotValidateIssuerName`: boolean. Determines whether the OpenID discovery process will validate the OpenID issuer name.
 - GET `OID/Del/PROVIDER_NAME`: This removes a configuration for OpenID for a given provider name.
 - GET `OID/Get`: Lists the configurations currently available.
 - GET `OID/States`: Lists currently active OpenID flows in progress.
diff --git a/SSO-Auth/Api/SSOController.cs b/SSO-Auth/Api/SSOController.cs
index 75981fc..43038e4 100644
--- a/SSO-Auth/Api/SSOController.cs
+++ b/SSO-Auth/Api/SSOController.cs
@@ -90,8 +90,9 @@ public class SSOController : ControllerBase
                 RedirectUri = GetRequestBase() + $"/sso/OID/{(Request.Path.Value.Contains("/start/", StringComparison.InvariantCultureIgnoreCase) ? "redirect" : "r")}/" + provider,
                 Scope = string.Join(" ", config.OidScopes.Prepend("openid profile")),
             };
-            options.Policy.Discovery.ValidateEndpoints = false; // For Google and other providers with different endpoints
-            options.Policy.Discovery.RequireHttps = config.RequireHttps;
+            options.Policy.Discovery.ValidateEndpoints = !config.DoNotValidateEndpoints; // For Google and other providers with different endpoints
+            options.Policy.Discovery.RequireHttps = !config.DisableHttps;
+            options.Policy.Discovery.ValidateIssuerName = !config.DoNotValidateIssuerName;
             var oidcClient = new OidcClient(options);
             var currentState = StateManager[state].State;
             var result = await oidcClient.ProcessResponseAsync(Request.QueryString.Value, currentState).ConfigureAwait(false);
@@ -425,7 +426,7 @@ public class SSOController : ControllerBase
     /// </param>
     /// <returns>A webpage that will complete the client-side flow.</returns>
     [HttpPost("SAML/p/{provider}")]
-    [HttpPost("SAML/start/{provider}")]
+    [HttpPost("SAML/post/{provider}")]
     public ActionResult SamlPost(string provider, [FromQuery] string relayState = null)
     {
         SamlConfig config;
@@ -520,7 +521,7 @@ public class SSOController : ControllerBase
 
             var request = new AuthRequest(
                 config.SamlClientId.Trim(),
-                GetRequestBase() + $"/sso/SAML/{(Request.Path.Value.Contains("/start/", StringComparison.InvariantCultureIgnoreCase) ? "start" : "p")}/" + provider);
+                GetRequestBase() + $"/sso/SAML/{(Request.Path.Value.Contains("/start/", StringComparison.InvariantCultureIgnoreCase) ? "post" : "p")}/" + provider);
 
             return Redirect(request.GetRedirectUrl(config.SamlEndpoint.Trim(), relayState));
         }
diff --git a/SSO-Auth/Config/PluginConfiguration.cs b/SSO-Auth/Config/PluginConfiguration.cs
index 1d525b8..f8de47a 100644
--- a/SSO-Auth/Config/PluginConfiguration.cs
+++ b/SSO-Auth/Config/PluginConfiguration.cs
@@ -276,7 +276,17 @@ public class OidConfig
     /// <summary>
     /// Gets or sets a value indicating whether HTTPS in the discovery endpoint is required.
     /// </summary>
-    public bool RequireHttps { get; set; }
+    public bool DisableHttps { get; set; }
+
+    /// <summary>
+    /// Gets or sets a value indicating whether the OpenID endpoints are validated.
+    /// </summary>
+    public bool DoNotValidateEndpoints { get; set; }
+
+    /// <summary>
+    /// Gets or sets a value indicating whether the OpenID issuer name is validated.
+    /// </summary>
+    public bool DoNotValidateIssuerName { get; set; }
 }
 
 /// <summary>
diff --git a/SSO-Auth/Config/configPage.html b/SSO-Auth/Config/configPage.html
index ebe6281..5fdf030 100644
--- a/SSO-Auth/Config/configPage.html
+++ b/SSO-Auth/Config/configPage.html
@@ -1,4 +1,4 @@
-<!doctype html>
+<!DOCTYPE html>
 <html lang="en">
   <head>
     <title>SSO</title>
@@ -447,7 +447,7 @@
                     <input
                       is="emby-checkbox"
                       id="EnableLiveTvManagement"
-                      name="EnableLiveTv"
+                      name="EnableLiveTvManagement"
                       type="checkbox"
                       class="sso-toggle"
                     />
@@ -559,6 +559,50 @@
                   </div>
                 </div>
 
+                <div class="checkboxContainer">
+                  <label>
+                    <input
+                      is="emby-checkbox"
+                      id="DisableHttps"
+                      name="DisableHttps"
+                      type="checkbox"
+                      class="sso-toggle"
+                    />
+                    <span>Disable OpenID HTTPS Discovery (Insecure)</span>
+                  </label>
+                  <div class="fieldDescription checkboxFieldDescription"></div>
+                </div>
+
+                <div
+                  class="checkboxContainer checkboxContainer-withDescription"
+                >
+                  <label>
+                    <input
+                      is="emby-checkbox"
+                      id="DoNotValidateEndpoints"
+                      name="DoNotValidateEndpoints"
+                      type="checkbox"
+                      class="sso-toggle"
+                    />
+                    <span>Do Not Validate OpenID Endpoints (Insecure)</span>
+                  </label>
+                  <div class="fieldDescription checkboxFieldDescription">
+                    May be required for Google OpenID
+                  </div>
+                </div>
+                <div class="checkboxContainer">
+                  <label>
+                    <input
+                      is="emby-checkbox"
+                      id="DoNotValidateIssuerName"
+                      name="DoNotValidateIssuerName"
+                      type="checkbox"
+                      class="sso-toggle"
+                    />
+                    <span>Do Not Validate OpenID Issuer Name (Insecure)</span>
+                  </label>
+                </div>
+
                 <button
                   id="SaveProvider"
                   is="emby-button"