From 01ab5b12e0a972c6fa6e44d72986ead95ef25e43 Mon Sep 17 00:00:00 2001
From: Erik Jan de Wit <erikjan.dewit@gmail.com>
Date: Mon, 7 Mar 2022 18:08:14 +0100
Subject: [PATCH] Added and removed saml fields (#2168)

---
 src/clients/ClientSettings.tsx | 149 ++++++++++++++++++++++++---------
 src/clients/help.ts            |   6 ++
 src/clients/messages.ts        |   4 +
 3 files changed, 120 insertions(+), 39 deletions(-)

diff --git a/src/clients/ClientSettings.tsx b/src/clients/ClientSettings.tsx
index 527fa49d71..60870e30dd 100644
--- a/src/clients/ClientSettings.tsx
+++ b/src/clients/ClientSettings.tsx
@@ -25,6 +25,8 @@ import { SaveReset } from "./advanced/SaveReset";
 import { SamlConfig } from "./add/SamlConfig";
 import { SamlSignature } from "./add/SamlSignature";
 import type { ClientForm } from "./ClientDetails";
+import environment from "../environment";
+import { useRealm } from "../context/realm-context/RealmContext";
 
 type ClientSettingsProps = {
   client: ClientRepresentation;
@@ -39,6 +41,7 @@ export const ClientSettings = ({
 }: ClientSettingsProps) => {
   const { register, control, watch, errors } = useFormContext<ClientForm>();
   const { t } = useTranslation("clients");
+  const { realm } = useRealm();
 
   const [loginThemeOpen, setLoginThemeOpen] = useState(false);
   const loginThemes = useServerInfo().themes!["login"];
@@ -48,6 +51,9 @@ export const ClientSettings = ({
   );
   const protocol = watch("protocol");
   const frontchannelLogout = watch("frontchannelLogout");
+  const idpInitiatedSsoUrlName: string = watch(
+    "attributes.saml_idp_initiated_sso_url_name"
+  );
 
   const sections = useMemo(() => {
     let result = ["generalSettings"];
@@ -97,22 +103,6 @@ export const ClientSettings = ({
                 ref={register}
               />
             </FormGroup>
-            <FormGroup
-              label={t("validRedirectUri")}
-              fieldId="kc-redirect"
-              labelIcon={
-                <HelpItem
-                  helpText="clients-help:validRedirectURIs"
-                  fieldLabelId="clients:validRedirectUri"
-                />
-              }
-            >
-              <MultiLineInput
-                name="redirectUris"
-                aria-label={t("validRedirectUri")}
-                addButtonLabel="clients:addRedirectUri"
-              />
-            </FormGroup>
             <FormGroup
               label={t("homeURL")}
               fieldId="kc-home-url"
@@ -131,40 +121,121 @@ export const ClientSettings = ({
               />
             </FormGroup>
             <FormGroup
-              label={t("webOrigins")}
-              fieldId="kc-web-origins"
+              label={t("validRedirectUri")}
+              fieldId="kc-redirect"
               labelIcon={
                 <HelpItem
-                  helpText="clients-help:webOrigins"
-                  fieldLabelId="clients:webOrigins"
+                  helpText="clients-help:validRedirectURIs"
+                  fieldLabelId="clients:validRedirectUri"
                 />
               }
             >
               <MultiLineInput
-                name="webOrigins"
-                aria-label={t("webOrigins")}
-                addButtonLabel="clients:addWebOrigins"
+                name="redirectUris"
+                aria-label={t("validRedirectUri")}
+                addButtonLabel="clients:addRedirectUri"
               />
             </FormGroup>
+            {protocol === "saml" && (
+              <>
+                <FormGroup
+                  label={t("idpInitiatedSsoUrlName")}
+                  fieldId="idpInitiatedSsoUrlName"
+                  labelIcon={
+                    <HelpItem
+                      helpText="clients-help:idpInitiatedSsoUrlName"
+                      fieldLabelId="clients:idpInitiatedSsoUrlName"
+                    />
+                  }
+                  helperText={
+                    idpInitiatedSsoUrlName !== "" &&
+                    t("idpInitiatedSsoUrlNameHelp", {
+                      url: `${environment.authServerUrl}/realms/${realm}/protocol/saml/clients/${idpInitiatedSsoUrlName}`,
+                    })
+                  }
+                >
+                  <TextInput
+                    type="text"
+                    id="idpInitiatedSsoUrlName"
+                    name="attributes.saml_idp_initiated_sso_url_name"
+                    ref={register}
+                  />
+                </FormGroup>
+                <FormGroup
+                  label={t("idpInitiatedSsoRelayState")}
+                  fieldId="idpInitiatedSsoRelayState"
+                  labelIcon={
+                    <HelpItem
+                      helpText="clients-help:idpInitiatedSsoRelayState"
+                      fieldLabelId="clients:idpInitiatedSsoRelayState"
+                    />
+                  }
+                >
+                  <TextInput
+                    type="text"
+                    id="idpInitiatedSsoRelayState"
+                    name="attributes.saml_idp_initiated_sso_relay_state"
+                    ref={register}
+                  />
+                </FormGroup>
+                <FormGroup
+                  label={t("masterSamlProcessingUrl")}
+                  fieldId="masterSamlProcessingUrl"
+                  labelIcon={
+                    <HelpItem
+                      helpText="clients-help:masterSamlProcessingUrl"
+                      fieldLabelId="clients:masterSamlProcessingUrl"
+                    />
+                  }
+                >
+                  <TextInput
+                    type="text"
+                    id="masterSamlProcessingUrl"
+                    name="adminUrl"
+                    ref={register}
+                  />
+                </FormGroup>
+              </>
+            )}
+            {protocol !== "saml" && (
+              <FormGroup
+                label={t("webOrigins")}
+                fieldId="kc-web-origins"
+                labelIcon={
+                  <HelpItem
+                    helpText="clients-help:webOrigins"
+                    fieldLabelId="clients:webOrigins"
+                  />
+                }
+              >
+                <MultiLineInput
+                  name="webOrigins"
+                  aria-label={t("webOrigins")}
+                  addButtonLabel="clients:addWebOrigins"
+                />
+              </FormGroup>
+            )}
           </>
         )}
-        <FormGroup
-          label={t("adminURL")}
-          fieldId="kc-admin-url"
-          labelIcon={
-            <HelpItem
-              helpText="clients-help:adminURL"
-              fieldLabelId="clients:adminURL"
+        {protocol !== "saml" && (
+          <FormGroup
+            label={t("adminURL")}
+            fieldId="kc-admin-url"
+            labelIcon={
+              <HelpItem
+                helpText="clients-help:adminURL"
+                fieldLabelId="clients:adminURL"
+              />
+            }
+          >
+            <TextInput
+              type="text"
+              id="kc-admin-url"
+              name="adminUrl"
+              ref={register}
             />
-          }
-        >
-          <TextInput
-            type="text"
-            id="kc-admin-url"
-            name="adminUrl"
-            ref={register}
-          />
-        </FormGroup>
+          </FormGroup>
+        )}
         {client.bearerOnly && (
           <SaveReset
             className="keycloak__form_actions"
diff --git a/src/clients/help.ts b/src/clients/help.ts
index 68d6a87b4a..29896a89f6 100644
--- a/src/clients/help.ts
+++ b/src/clients/help.ts
@@ -142,6 +142,12 @@ export default {
       "JWE algorithm, which client needs to use when encrypting the content of the OIDC request object specified by 'request' or 'request_uri' parameters. If set to 'any', any algorithm is allowed.",
     validRequestURIs:
       "List of valid URIs, which can be used as values of 'request_uri' parameter during OpenID Connect authentication request. There is support for the same capabilities like for Valid Redirect URIs. For example wildcards or relative paths.",
+    idpInitiatedSsoUrlName:
+      "URL fragment name to reference client when you want to do IDP Initiated SSO. Leaving this empty will disable IDP Initiated SSO. The URL you will reference from your browser will be: {server-root}/realms/{realm}/protocol/saml/clients/{client-url-name}",
+    idpInitiatedSsoRelayState:
+      "Relay state you want to send with SAML request when you want to do IDP Initiated SSO.",
+    masterSamlProcessingUrl:
+      "If configured, this URL will be used for every binding to both the SP's Assertion Consumer and Single Logout Services. This can be individually overridden for each binding and service in the Fine Grain SAML Endpoint Configuration.",
     authorizationSignedResponseAlg:
       "JWA algorithm used for signing authorization response tokens when the response mode is jwt.",
     authorizationEncryptedResponseAlg:
diff --git a/src/clients/messages.ts b/src/clients/messages.ts
index 76ae9dcad4..362dcac7f4 100644
--- a/src/clients/messages.ts
+++ b/src/clients/messages.ts
@@ -374,6 +374,10 @@ export default {
     accessSettings: "Access settings",
     rootUrl: "Root URL",
     validRedirectUri: "Valid redirect URIs",
+    idpInitiatedSsoUrlName: "IDP-Initiated SSO URL name",
+    idpInitiatedSsoUrlNameHelp: "Target IDP initiated SSO URL: {{url}}",
+    idpInitiatedSsoRelayState: "IDP Initiated SSO Relay State",
+    masterSamlProcessingUrl: "Master SAML Processing URL",
     samlCapabilityConfig: "SAML capabilities",
     signatureAndEncryption: "Signature and Encryption",
     nameIdFormat: "Name ID format",