Doesn't work with SAML Google Workspase

[lunahod2022]

Can't get it to work with SAML Google. This module is in Wiki.JS. What should I enter in the settings of Google itself?

[cjbarth]

Do you have a link to what you are referencing?

[srd90]

@cjbarth wiki.js is https://github.com/requarks/wiki

@lunahod2022 be aware that current wiki.js has very unsecure version of passport-saml. At the moment wiki.js's passport-saml instance can be configured so that authentication is effectively disabled. I.e. attacker could impersonate anyone if wiki.js administrator does not pay attention to cert parameter and such configuration error is remotely exploitable. For further information see: requarks/wiki#5180

[lunahod2022]

@srd90 how can i make passport-saml more secure? update it? Or enable forced verification of certificates?

And the question is still open. I do not understand how to properly configure authentication with Google Workspace.

[cjbarth]

That project needs to upgrade the version of passport-saml they are using. We are on v3 and about to release v4. There have been a ton of changes since 1.3.5.

For us to help you configure something, it would be nice to know what you've tried and what problems you're encountering.

[lunahod2022]

@cjbarth I filled in the fields "Entry point" - URL SSO, "Issuer" - google_workspace, "Certificate" in the wiki.js. In Google I filled "URL ACS" and "Object ID".

When I try to log in, I get various errors from Google. Now the error is "the application is not available to the user", although in the security settings it is active for everyone.

[lunahod2022]

@cjbarth @srd90 several times I tried to configure SAML in different ways, but something does not work out. I don’t understand what settings I should specify on the Google side and I’m not sure if the settings on the Wiki.JS side are entered correctly

[cjbarth]

I see that Wiki.JS has updated to v3 of passport-saml. Has this helped any of your issues?

[srd90]

fwiw, based on this report: #521 (comment)
passport-saml has not been "root cause" for wiki.js & google workspaces related authentication problems.