fix: make SAML paths better; improve and add OID discovery defaults

README.md

@@ -236,7 +236,9 @@ These all require authorization. Append an API key to the end of the request: `c
     - Leave empty to only request the default scopes.
   - `defaultProvider`: string. The set provider then gets assigned to the user after they have logged in. If it is not set, nothing is changed. With this, a user can login with SSO but is still able to log in via other providers later. See the `Unregister` endpoint.
   - `defaultUsernameClaim`: string. The provider will use the claim to create the users' usernames. If not set, it fallbacks to `preferred_username`.
-  - `requireHttps`: boolean. Determines whether the OpenID discovery endpoint requires HTTP. It is advised NOT to set this to false. If not set, it fallbacks to `true`.
+  - `disableHttps`: boolean. Determines whether the OpenID discovery endpoint requires HTTPS.
+  - `doNotValidateEndpoints`: boolean. Determines whether the OpenID discovery process will validate endpoints. This may be required for Google.
+  - `doNotValidateIssuerName`: boolean. Determines whether the OpenID discovery process will validate the OpenID issuer name.
 - GET `OID/Del/PROVIDER_NAME`: This removes a configuration for OpenID for a given provider name.
 - GET `OID/Get`: Lists the configurations currently available.
 - GET `OID/States`: Lists currently active OpenID flows in progress.

SSO-Auth/Api/SSOController.cs

@@ -90,8 +90,9 @@ public class SSOController : ControllerBase
                 RedirectUri = GetRequestBase() + $"/sso/OID/{(Request.Path.Value.Contains("/start/", StringComparison.InvariantCultureIgnoreCase) ? "redirect" : "r")}/" + provider,
                 Scope = string.Join(" ", config.OidScopes.Prepend("openid profile")),
             };
-            options.Policy.Discovery.ValidateEndpoints = false; // For Google and other providers with different endpoints
-            options.Policy.Discovery.RequireHttps = config.RequireHttps;
+            options.Policy.Discovery.ValidateEndpoints = !config.DoNotValidateEndpoints; // For Google and other providers with different endpoints
+            options.Policy.Discovery.RequireHttps = !config.DisableHttps;
+            options.Policy.Discovery.ValidateIssuerName = !config.DoNotValidateIssuerName;
             var oidcClient = new OidcClient(options);
             var currentState = StateManager[state].State;
             var result = await oidcClient.ProcessResponseAsync(Request.QueryString.Value, currentState).ConfigureAwait(false);
@@ -425,7 +426,7 @@ public class SSOController : ControllerBase
     /// </param>
     /// <returns>A webpage that will complete the client-side flow.</returns>
     [HttpPost("SAML/p/{provider}")]
-    [HttpPost("SAML/start/{provider}")]
+    [HttpPost("SAML/post/{provider}")]
     public ActionResult SamlPost(string provider, [FromQuery] string relayState = null)
     {
         SamlConfig config;
@@ -520,7 +521,7 @@ public class SSOController : ControllerBase
 
             var request = new AuthRequest(
                 config.SamlClientId.Trim(),
-                GetRequestBase() + $"/sso/SAML/{(Request.Path.Value.Contains("/start/", StringComparison.InvariantCultureIgnoreCase) ? "start" : "p")}/" + provider);
+                GetRequestBase() + $"/sso/SAML/{(Request.Path.Value.Contains("/start/", StringComparison.InvariantCultureIgnoreCase) ? "post" : "p")}/" + provider);
 
             return Redirect(request.GetRedirectUrl(config.SamlEndpoint.Trim(), relayState));
         }

SSO-Auth/Config/PluginConfiguration.cs

@@ -276,7 +276,17 @@ public class OidConfig
     /// <summary>
     /// Gets or sets a value indicating whether HTTPS in the discovery endpoint is required.
     /// </summary>
-    public bool RequireHttps { get; set; }
+    public bool DisableHttps { get; set; }
+
+    /// <summary>
+    /// Gets or sets a value indicating whether the OpenID endpoints are validated.
+    /// </summary>
+    public bool DoNotValidateEndpoints { get; set; }
+
+    /// <summary>
+    /// Gets or sets a value indicating whether the OpenID issuer name is validated.
+    /// </summary>
+    public bool DoNotValidateIssuerName { get; set; }
 }
 
 /// <summary>

SSO-Auth/Config/configPage.html

@@ -1,4 +1,4 @@
-<!doctype html>
+<!DOCTYPE html>
 <html lang="en">
   <head>
     <title>SSO</title>
@@ -447,7 +447,7 @@
                     <input
                       is="emby-checkbox"
                       id="EnableLiveTvManagement"
-                      name="EnableLiveTv"
+                      name="EnableLiveTvManagement"
                       type="checkbox"
                       class="sso-toggle"
                     />
@@ -559,6 +559,50 @@
                   </div>
                 </div>
 
+                <div class="checkboxContainer">
+                  <label>
+                    <input
+                      is="emby-checkbox"
+                      id="DisableHttps"
+                      name="DisableHttps"
+                      type="checkbox"
+                      class="sso-toggle"
+                    />
+                    <span>Disable OpenID HTTPS Discovery (Insecure)</span>
+                  </label>
+                  <div class="fieldDescription checkboxFieldDescription"></div>
+                </div>
+
+                <div
+                  class="checkboxContainer checkboxContainer-withDescription"
+                >
+                  <label>
+                    <input
+                      is="emby-checkbox"
+                      id="DoNotValidateEndpoints"
+                      name="DoNotValidateEndpoints"
+                      type="checkbox"
+                      class="sso-toggle"
+                    />
+                    <span>Do Not Validate OpenID Endpoints (Insecure)</span>
+                  </label>
+                  <div class="fieldDescription checkboxFieldDescription">
+                    May be required for Google OpenID
+                  </div>
+                </div>
+                <div class="checkboxContainer">
+                  <label>
+                    <input
+                      is="emby-checkbox"
+                      id="DoNotValidateIssuerName"
+                      name="DoNotValidateIssuerName"
+                      type="checkbox"
+                      class="sso-toggle"
+                    />
+                    <span>Do Not Validate OpenID Issuer Name (Insecure)</span>
+                  </label>
+                </div>
+
                 <button
                   id="SaveProvider"
                   is="emby-button"