TODOs

Migrate auth to the saml addon (replaces oauth2-proxy + ldapauth + double-login)

Why: Friendica currently authenticates in two steps: oauth2-proxy gates the vhost (Keycloak-Authorization-Code-Flow, 2FA-enforceable), then the user must fill Friendica’s own /login form because stock Friendica has no header-trusted auto-login — Owa.php / OAuth/Token.php only read HTTP_AUTHORIZATION for API endpoints, never for the web session. The ldapauth addon stays enabled solely as a first-login bootstrap that materialises the friendica.user row from openldap.

The double-login is UX-hostile (creds typed twice) and the second hop silently bypasses any 2FA Keycloak enforced on the first hop — anyone with the LDAP password can reach the app even when WebAuthn/OTP is required at the IdP. Friendica’s stock saml addon (already on disk under /var/www/html/addon/saml/) supports a SAML2 AuthnRequest → IdP-initiated SSO with auto-account-creation, which collapses the chain to a single 2FA-gated round-trip.

Migration outline (~4-6h):

  1. Enable addons.saml: {} in meta/services.yml (and drop addons.ldapauth: {} plus services.oauth2 once SAML autocreate is verified).

  2. Template saml.config.php.j2 analogous to ldapauth.config.php.j2: IdP-metadata-URL, SP-Entity-ID, SP-ACS-URL, NameID format, attribute map (email/firstName/lastName/groups), signing/encryption cert paths.

  3. Mount the rendered saml.config.php in compose.yml.j2 (analogous to ldapauth).

  4. Provision a SAML client in Keycloak (extend roles/web-app-keycloak’s client-provisioning logic which currently only handles OIDC clients). Attribute mappers, SP-metadata import, signing certificate alignment.

  5. Drop services.sso.enabled for friendica — SAML handles SSO end-to- end, oauth2-proxy in front would double-gate.

  6. Rewrite files/playwright/playwright.spec.js to use the generic admin/biber persona flows (remove PERSONA_*_BLOCKED=true from templates/playwright.env.j2, drop the bespoke loginViaOauth2ProxyAndFriendica helper, drop the FRIENDICA_BASE_URL env var).

Risks / unknowns:

  • Friendica’s saml addon is community-maintained — last-commit recency AND config-format compatibility need verification before committing to it as the canonical SSO path.

  • SAML cert lifecycle (rotation, alignment between Friendica SP and Keycloak IdP) is a new maintenance burden — clarify ownership before shipping.

  • First-login autocreate via SAML’s auto_register option must be tested with both the administrator and biber openldap-sourced identities before ldapauth is removed.