({
+ ssoUserURL: appConfig.sso_settings?.sso_server_url || "",
mdmAppleServerURL: appConfig.mdm?.apple_server_url || "",
domain: appConfig.smtp_settings?.domain || "",
verifySSLCerts: appConfig.smtp_settings?.verify_ssl_certs || false,
@@ -97,6 +107,7 @@ const Advanced = ({
});
const {
+ ssoUserURL,
mdmAppleServerURL,
domain,
verifySSLCerts,
@@ -179,6 +190,9 @@ const Advanced = ({
mdm: {
apple_server_url: mdmAppleServerURL,
},
+ sso_settings: {
+ sso_server_url: ssoUserURL,
+ },
};
handleSubmit(formDataToSubmit);
@@ -193,6 +207,25 @@ const Advanced = ({
Most users do not need to modify these options.
+ (
+
+ )}
+ />
{appConfig.mdm.enabled_and_configured && (
+
+
+
+
+ MIIDXTCCAkWgAwIBAgIJALmVVuDWu4NYMA0GCSqGSIb3DQEBCwUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIDApTb21lLVN0YXRlMSEwHwYDVQQKDBhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMTYxMjMxMTQzNDQ3WhcNNDgwNjI1MTQzNDQ3WjBFMQswCQYDVQQGEwJBVTETMBEGA1UECAwKU29tZS1TdGF0ZTEhMB8GA1UECgwYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAzUCFozgNb1h1M0jzNRSCjhOBnR+uVbVpaWfXYIR+AhWDdEe5ryY+CgavOg8bfLybyzFdehlYdDRgkedEB/GjG8aJw06l0qF4jDOAw0kEygWCu2mcH7XOxRt+YAH3TVHa/Hu1W3WjzkobqqqLQ8gkKWWM27fOgAZ6GieaJBN6VBSMMcPey3HWLBmc+TYJmv1dbaO2jHhKh8pfKw0W12VM8P1PIO8gv4Phu/uuJYieBWKixBEyy0lHjyixYFCR12xdh4CA47q958ZRGnnDUGFVE1QhgRacJCOZ9bd5t9mr8KLaVBYTCJo5ERE8jymab5dPqe5qKfJsCZiqWglbjUo9twIDAQABo1AwTjAdBgNVHQ4EFgQUxpuwcs/CYQOyui+r1G+3KxBNhxkwHwYDVR0jBBgwFoAUxpuwcs/CYQOyui+r1G+3KxBNhxkwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAAiWUKs/2x/viNCKi3Y6blEuCtAGhzOOZ9EjrvJ8+COH3Rag3tVBWrcBZ3/uhhPq5gy9lqw4OkvEws99/5jFsX1FJ6MKBgqfuy7yh5s1YfM0ANHYczMmYpZeAcQf2CGAaVfwTTfSlzNLsF2lW/ly7yapFzlYSJLGoVE+OHEu8g5SlNACUEfkXw+5Eghh+KzlIN7R6Q7r2ixWNFBC/jWf7NKUfJyX8qIG5md1YUeT6GBW9Bm2/1/RiO24JTaYlfLdKK9TYb8sG5B+OLab2DImG99CJ25RkAcSobWNF5zD0O6lgOo3cEdB/ksCq3hmtlC/DlLZ/D8CJ+7VuZnS1rR2naQ==
+
+
+
+
+ urn:oasis:names:tc:SAML:2.0:nameid-format:transient
+
+
+`
+
+ // Configure SSO with a specific SSO server URL and inline metadata
+ acResp := appConfigResponse{}
+ s.DoJSON("PATCH", "/api/latest/fleet/config", json.RawMessage(fmt.Sprintf(`{
+ "sso_settings": {
+ "enable_sso": true,
+ "entity_id": "https://localhost:8080",
+ "idp_name": "SimpleSAML",
+ "metadata": %q,
+ "enable_jit_provisioning": false,
+ "sso_server_url": "https://admin.localhost:8080"
+ }
+ }`, testMetadata)), http.StatusOK, &acResp)
+ require.NotNil(t, acResp)
+
+ // Verify the SSO server URL is set
+ require.NotNil(t, acResp.SSOSettings)
+ require.Equal(t, "https://admin.localhost:8080", acResp.SSOSettings.SSOServerURL)
+
+ // Initiate SSO
+ var resIni initiateSSOResponse
+ s.DoJSON("POST", "/api/v1/fleet/sso", map[string]string{}, http.StatusOK, &resIni)
+ require.NotEmpty(t, resIni.URL)
+
+ // Parse the auth request to verify it uses the SSO URL
+ parsed, err := url.Parse(resIni.URL)
+ require.NoError(t, err)
+ q := parsed.Query()
+ encoded := q.Get("SAMLRequest")
+ assert.NotEmpty(t, encoded)
+ authReq := inflate(t, encoded)
+
+ // Check that the ACS URL in the auth request uses the SSO server URL
+ require.NotNil(t, authReq.AssertionConsumerServiceURL)
+ assert.Equal(t, "https://admin.localhost:8080/api/v1/fleet/sso/callback", authReq.AssertionConsumerServiceURL)
+}
diff --git a/server/service/sessions.go b/server/service/sessions.go
index c179e8e6ee..9a4ca571d5 100644
--- a/server/service/sessions.go
+++ b/server/service/sessions.go
@@ -441,7 +441,12 @@ func (svc *Service) InitiateSSO(ctx context.Context, redirectURL string) (sessio
}
serverURL := appConfig.ServerSettings.ServerURL
- acsURL := serverURL + svc.config.Server.URLPrefix + "/api/v1/fleet/sso/callback"
+ // Use SSO server URL if configured, otherwise use the server URL
+ ssoURL := serverURL
+ if appConfig.SSOSettings != nil && appConfig.SSOSettings.SSOServerURL != "" {
+ ssoURL = appConfig.SSOSettings.SSOServerURL
+ }
+ acsURL := ssoURL + svc.config.Server.URLPrefix + "/api/v1/fleet/sso/callback"
// If entityID is not explicitly set, default to host name.
//
@@ -650,7 +655,12 @@ func (svc *Service) InitSSOCallback(
}
serverURL := appConfig.ServerSettings.ServerURL
- acsURL, err := url.Parse(serverURL + svc.config.Server.URLPrefix + "/api/v1/fleet/sso/callback")
+ // Use SSO server URL if configured, otherwise use the server URL
+ ssoURL := serverURL
+ if appConfig.SSOSettings != nil && appConfig.SSOSettings.SSOServerURL != "" {
+ ssoURL = appConfig.SSOSettings.SSOServerURL
+ }
+ acsURL, err := url.Parse(ssoURL + svc.config.Server.URLPrefix + "/api/v1/fleet/sso/callback")
if err != nil {
return nil, "", ctxerr.Wrap(ctx, err, "failed to parse ACS URL")
}
@@ -658,7 +668,14 @@ func (svc *Service) InitSSOCallback(
expectedAudiences := []string{
appConfig.SSOSettings.EntityID,
appConfig.ServerSettings.ServerURL,
- appConfig.ServerSettings.ServerURL + svc.config.Server.URLPrefix + "/api/v1/fleet/sso/callback", // ACS
+ appConfig.ServerSettings.ServerURL + svc.config.Server.URLPrefix + "/api/v1/fleet/sso/callback", // ACS with server URL
+ }
+ // Add SSO server URL to expected audiences if configured
+ if appConfig.SSOSettings != nil && appConfig.SSOSettings.SSOServerURL != "" {
+ expectedAudiences = append(expectedAudiences,
+ appConfig.SSOSettings.SSOServerURL,
+ appConfig.SSOSettings.SSOServerURL+svc.config.Server.URLPrefix+"/api/v1/fleet/sso/callback", // ACS with SSO server URL
+ )
}
samlProvider, requestID, redirectURL, err := sso.SAMLProviderFromSessionOrConfiguredMetadata(
ctx, sessionID, svc.ssoSessionStore, acsURL, appConfig.SSOSettings, expectedAudiences,
diff --git a/server/service/sessions_test.go b/server/service/sessions_test.go
index 4d15af5aea..f8de66e61c 100644
--- a/server/service/sessions_test.go
+++ b/server/service/sessions_test.go
@@ -8,6 +8,7 @@ import (
"github.com/fleetdm/fleet/v4/server/config"
"github.com/fleetdm/fleet/v4/server/contexts/viewer"
"github.com/fleetdm/fleet/v4/server/datastore/mysql"
+ "github.com/fleetdm/fleet/v4/server/datastore/redis/redistest"
"github.com/fleetdm/fleet/v4/server/fleet"
"github.com/fleetdm/fleet/v4/server/mock"
"github.com/fleetdm/fleet/v4/server/ptr"
@@ -436,3 +437,54 @@ func TestGetSSOUser(t *testing.T) {
_, err = svc.GetSSOUser(ctx, auth)
require.Error(t, err)
}
+
+func TestInitiateSSOWithSSOServerURL(t *testing.T) {
+ ds := new(mock.Store)
+ pool := redistest.SetupRedis(t, t.Name(), false, false, false)
+
+ svc, ctx := newTestServiceWithConfig(t, ds, config.TestConfig(), nil, nil, &TestServerOpts{
+ Pool: pool,
+ })
+
+ // Mock app config with SSO server URL
+ appConfig := &fleet.AppConfig{
+ ServerSettings: fleet.ServerSettings{
+ ServerURL: "https://fleet.example.com",
+ },
+ SSOSettings: &fleet.SSOSettings{
+ EnableSSO: true,
+ SSOServerURL: "https://admin.fleet.example.com",
+ SSOProviderSettings: fleet.SSOProviderSettings{
+ EntityID: "fleet",
+ IDPName: "TestIDP",
+ Metadata: `
+
+
+
+
+
+ MIIDXTCCAkWgAwIBAgIJALmVVuDWu4NYMA0GCSqGSIb3DQEBCwUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIDApTb21lLVN0YXRlMSEwHwYDVQQKDBhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMTYxMjMxMTQzNDQ3WhcNNDgwNjI1MTQzNDQ3WjBFMQswCQYDVQQGEwJBVTETMBEGA1UECAwKU29tZS1TdGF0ZTEhMB8GA1UECgwYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAzUCFozgNb1h1M0jzNRSCjhOBnR+uVbVpaWfXYIR+AhWDdEe5ryY+CgavOg8bfLybyzFdehlYdDRgkedEB/GjG8aJw06l0qF4jDOAw0kEygWCu2mcH7XOxRt+YAH3TVHa/Hu1W3WjzkobqqqLQ8gkKWWM27fOgAZ6GieaJBN6VBSMMcPey3HWLBmc+TYJmv1dbaO2jHhKh8pfKw0W12VM8P1PIO8gv4Phu/uuJYieBWKixBEyy0lHjyixYFCR12xdh4CA47q958ZRGnnDUGFVE1QhgRacJCOZ9bd5t9mr8KLaVBYTCJo5ERE8jymab5dPqe5qKfJsCZiqWglbjUo9twIDAQABo1AwTjAdBgNVHQ4EFgQUxpuwcs/CYQOyui+r1G+3KxBNhxkwHwYDVR0jBBgwFoAUxpuwcs/CYQOyui+r1G+3KxBNhxkwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAAiWUKs/2x/viNCKi3Y6blEuCtAGhzOOZ9EjrvJ8+COH3Rag3tVBWrcBZ3/uhhPq5gy9lqw4OkvEws99/5jFsX1FJ6MKBgqfuy7yh5s1YfM0ANHYczMmYpZeAcQf2CGAaVfwTTfSlzNLsF2lW/ly7yapFzlYSJLGoVE+OHEu8g5SlNACUEfkXw+5Eghh+KzlIN7R6Q7r2ixWNFBC/jWf7NKUfJyX8qIG5md1YUeT6GBW9Bm2/1/RiO24JTaYlfLdKK9TYb8sG5B+OLab2DImG99CJ25RkAcSobWNF5zD0O6lgOo3cEdB/ksCq3hmtlC/DlLZ/D8CJ+7VuZnS1rR2naQ==
+
+
+
+
+
+`,
+ },
+ },
+ }
+
+ ds.AppConfigFunc = func(ctx context.Context) (*fleet.AppConfig, error) {
+ return appConfig, nil
+ }
+
+ // Test that ACS URL uses SSO URL
+ sessionID, _, idpURL, err := svc.InitiateSSO(ctx, "/dashboard")
+ require.NoError(t, err)
+ require.NotEmpty(t, sessionID)
+ require.NotEmpty(t, idpURL)
+
+ // The ACS URL should use the SSO server URL
+ // We can't directly test the ACS URL in the SAML request here since it's embedded in the XML,
+ // but the integration test verifies this works correctly
+}
diff --git a/tools/cloner-check/generated_files/appconfig.txt b/tools/cloner-check/generated_files/appconfig.txt
index 5c15421c1f..9b91c90421 100644
--- a/tools/cloner-check/generated_files/appconfig.txt
+++ b/tools/cloner-check/generated_files/appconfig.txt
@@ -53,6 +53,7 @@ github.com/fleetdm/fleet/v4/server/fleet/SSOSettings EnableSSO bool
github.com/fleetdm/fleet/v4/server/fleet/SSOSettings EnableSSOIdPLogin bool
github.com/fleetdm/fleet/v4/server/fleet/SSOSettings EnableJITProvisioning bool
github.com/fleetdm/fleet/v4/server/fleet/SSOSettings EnableJITRoleSync bool
+github.com/fleetdm/fleet/v4/server/fleet/SSOSettings SSOServerURL string
github.com/fleetdm/fleet/v4/server/fleet/AppConfig FleetDesktop fleet.FleetDesktopSettings
github.com/fleetdm/fleet/v4/server/fleet/FleetDesktopSettings TransparencyURL string
github.com/fleetdm/fleet/v4/server/fleet/AppConfig VulnerabilitySettings fleet.VulnerabilitySettings