[Due for payment 2025-12-23] [SAML Configuration] When enabling "Require SAML login" with empty metadata field, toggle auto disables

[jponikarchuk]

If you haven’t already, check out our contributing guidelines for onboarding and email contributors@expensify.com to request to join our Slack channel!

---

Version Number: 9.2.66-0
Reproducible in staging?: Yes
Reproducible in production?: Yes
If this was caught during regression testing, add the test name, ID and link from BrowserStack: #74973
Email or phone of affected tester (no customers): applausetester@applause.expensifail.com
Issue reported by: Applause Internal Team
Device used: Mac 26.1 / Chrome
App Component: Other

Action Performed:

1. Go to staging.new.expensify.com
2. Log in to applausetester@applause.expensifail.com
3. Go to Workspaces tab.
4. Open applausecard.expensifail.com under Domains section.
5. Enable SAML login.
6. With empty "Identity Provider MetaData" field, enable "Require SAML login".

Expected Result:

There should be an error when enabling "Require SAML login" with empty "Identity Provider MetaData" field.

Actual Result:

There is no error when enabling "Require SAML login" with empty "Identity Provider MetaData" field.
The toggle auto disables after enabling it.

On Old Dot, we get the errror "The XML Identity Provider Metadata is invalid. Please update it with valid XML before proceeding.".

Workaround:

Unknown

Platforms:

• Android: App
• Android: mWeb Chrome
• iOS: App
• iOS: mWeb Safari
• iOS: mWeb Chrome
• Windows: Chrome
• MacOS: Chrome / Safari
• MacOS: Desktop

Screenshots/Videos

1.mp4

View all open jobs on GitHub

Issue Owner

Current Issue Owner: @johncschuster

[melvin-bot]

Triggered auto assignment to @johncschuster (Bug), see https://stackoverflow.com/c/expensify/questions/14418 for more details. Please add this bug to a GH project, as outlined in the SO.

[Eskalifer1]

Proposal

Please re-state the problem that we are trying to solve in this issue.

SAML - When enabling "Require SAML login" with empty metadata field, toggle auto disables

What is the root cause of that problem?

Backend return error for key samlMetadataError, but we check for:

App/src/pages/domain/Saml/SamlLoginSectionContent.tsx

Line 64 in 1dac980

errors={getLatestErrorMessageField({errors: domain?.samlRequiredError})}

What changes do you think we should make in order to solve the problem?

We should update check for samlMetadataError and update this functions or create a new one:

App/src/pages/domain/Saml/SamlLoginSectionContent.tsx

Lines 65 to 66 in 1dac980

	onClose={() => resetSamlRequiredError(accountID)}
	dismissError={() => resetSamlRequiredError(accountID)}

And update types and this selector:

App/src/selectors/Domain.ts

Lines 6 to 14 in 1dac980

	const domainSamlSettingsStateSelector = (domain: OnyxEntry<Domain>) =>
	domain
	? {
	isSamlEnabledLoading: domain.isSamlEnabledLoading,
	samlEnabledError: domain.samlEnabledError,
	isSamlRequiredLoading: domain.isSamlRequiredLoading,
	samlRequiredError: domain.samlRequiredError,
	}
	: undefined;

And update this field:

App/src/libs/actions/Domain.ts

Line 239 in 1dac980

samlRequiredError: null,

Ps: we might want to consider adding validation on toggle

What alternative solutions did you explore? (Optional)

1. We can add error message here for this field:
   

   App/src/libs/actions/Domain.ts

   Lines 250 to 265 in 1dac980

   	const failureData: OnyxUpdate[] = [
   	{
   	onyxMethod: Onyx.METHOD.MERGE,
   	key: `${ONYXKEYS.COLLECTION.DOMAIN}${accountID}`,
   	value: {isSamlRequiredLoading: null},
   	},
   	{
   	onyxMethod: Onyx.METHOD.MERGE,
   	key: `${ONYXKEYS.COLLECTION.SHARED_NVP_PRIVATE_DOMAIN_MEMBER}${accountID}`,
   	value: {
   	settings: {
   	samlRequired: !required,
   	},
   	},
   	},
   	];

   
   Reminder: Please use plain English, be brief and avoid jargon. Feel free to use images, charts or pseudo-code if necessary. Do not post large multi-line diffs or write walls of text. Do not create PRs unless you have been hired for this job.

[mhawryluk]

we can check if the metaIdentity is empty when the user tries to set SAML as required and if so set the error, instead of sending the request to backend. and we could either set samlRequiredError -> the error would be in the toggle row, where the action was made by the user or samlMetadataError -> it would display under the identity provider metadata which is the data that is incorrect.

one thing to consider is that we're doing an optimistic update for the metaIdentity so when a user enters a wrong metaIdentity we display an error, but in Onyx the data is set to the new value and it remains so as long as they don't enter another value or refresh the page. so the data in frontend isn't necessarily the same as the one actually used on the backend side. so if we don't change this, then when the user has empty metaIdentity in the database, but previously entered some invalid metaIdentity, we would not catch this as an empty metaIdentity and send request to the backend. but the error would be visible under the metaIdentity row regardless.

or alternatively the backend could set the 'samlRequiredError' (and/or samlMetadataError) when turning on the required setting with invalid metaIdentity.

I hope this makes sense. @NikkiWines what do you think?

[NikkiWines]

Sorry for the delay @mhawryluk - I guess in this case we can have the backend handle it - which is already does - and just bubble up the error under the identity provider metadata. It's a bit weird though... since the action being taken doesn't reflect where the error surfaces

Or we could disable the toggle while the metadata is empty 🤔 though i guess we'd need to tell the user why we're doing that... so either way we need to display something

@mountiny do you have an opinion here?

[mountiny]

I think to handle this with UX patterns we already have in the app - if we know the metadata is empty and it should fail - we should allow the admin to click on the toggle BUT not make there request and show the validation error at the moment explaining the metadata is invalid.

In the case where its invalid locally and we make the request the BE already returns correct error so we can keep showing that

[mhawryluk]

that makes sense, thanks! just to clarify, in this situation when the user tries to enable saml required before entering in the metaIdentity, the shown error would be something like:

1. "Cannot enable SAML required without specifying Identity Provider MetaData" under the saml required toggle. OR
2. "The XML Identity Provider Metadata is invalid. Please update it with valid XML before proceeding." under the Identity Provider MetaData row?

the first one makes sense, because this is where the action is taken, but 2. is consistent with how it would work if the user entered some metaIdentity but it was invalid.