SSO:How to get array of groups in redmine ominiauth SAML plugin from the SAML respone? - single-sign-on

Question

Implementing SSO for redmine: Idp- OpenAM, SP-redmine (Ominiauth SAML plugin)
I want to get list of groups which are assigned to user in redmine_ominiauth_saml plugin but I can get just single group which is first on SAML response in groups assertion.
So is there any different configuration for array attribute:
Mapping of attributes for SP on OpenAM:
groups=isMemberOf
last_name=sn
username=mail
first_name=givenName
email=mail
Mapping of attributes on Redmine:
"/opt/redmine/config/initializers/saml_3.0.rb"
:attribute_mapping => {
# How will we map attributes from SSO to redmine attribute
:login => 'extra.raw_info.username',
:firstname => 'extra.raw_info.first_name',
:lastname => 'extra.raw_info.last_name',
:mail => 'extra.raw_info.email',
:isMemberOf => 'extra.raw_info.groups'
}
SAML response contains attribute groups in array like this:
<saml:AttributeStatement>
<saml:Attribute Name="first_name">
<saml:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:type="xs:string"
>umesh</saml:AttributeValue>
</saml:Attribute>
<saml:Attribute Name="username">
<saml:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:type="xs:string"
>ubr#abc.com</saml:AttributeValue>
</saml:Attribute>
<saml:Attribute Name="email">
<saml:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:type="xs:string"
>ubr#abc.com</saml:AttributeValue>
</saml:Attribute>
<saml:Attribute Name="last_name">
<saml:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:type="xs:string"
>rajani</saml:AttributeValue>
</saml:Attribute>
<saml:Attribute Name="groups">
<saml:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:type="xs:string"
>cn=ABC,ou=groups,dc=abc,dc=opendj,dc=com</saml:AttributeValue>
<saml:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:type="xs:string"
>cn=XYZ,ou=groups,dc=abc,dc=opendj,dc=com</saml:AttributeValue>
<saml:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:type="xs:string"
>cn=YZQ,ou=groups,dc=abc,dc=opendj,dc=com</saml:AttributeValue>
</saml:Attribute>
</saml:AttributeStatement>
I knew this code in SAML plugin gives me single group (code in ruby):
/opt/redmine/plugins/redmine_omniauth_saml/lib/redmine_omniauth_saml.rb
def user_attributes_from_saml(omniauth)
HashWithIndifferentAccess.new.tap do |h|
required_attribute_mapping.each do |symbol|
key = configured_saml[:attribute_mapping][symbol]
h[symbol] = key.split('.') # Get an array with nested keys: name.first will return [name, first]
.map {|x| [:[], x]} # Create pair elements being :[] symbol and the key
.inject(omniauth) do |hash, params| # For each key, apply method :[] with key as parameter
hash.send(*params)
end
**print "key:value "+key+":" +h[symbol]** # gives key value pair, first_name, group 'ABC' only leaves other group
end
end
end

Answer 1

Actually ruby-saml plugin is default retrun as attributes as single value.
We need to set as for multi value in ruby-saml plugin.
ruby-saml plugin have attributes.rb file.
Update the value of ##single_value_compatibility and set as "false"
Now you are getting full array of value.
Hope you issue will resolved.