saml: allow specification of the IdP entityid

changelog.d/8630.feature

@@ -0,0 +1 @@
+Allow specification of the SAML IdP if the metadata returns multiple IdPs.

docs/sample_config.yaml

@@ -1640,6 +1640,14 @@ saml2_config:
   #  - attribute: department
   #    value: "sales"
 
+  # Most metadata XML only contains a single IdP entity. However if the
+  # metadata XML contains multiple IdPs Synapse needs to know which IdP to
+  # redirect users to. `idp_entityid` can be populated with the entity of
+  # the IdP that should be used. For most deployments, this parameter should
+  # be omitted.
+  #
+  #idp_entityid: 'https://our_idp/entityid'
+
 
 # OpenID Connect integration. The following settings can be used to make Synapse
 # use an OpenID Connect Provider for authentication, instead of its internal

synapse/config/saml2_config.py

@@ -90,6 +90,8 @@ def read_config(self, config, **kwargs):
             "grandfathered_mxid_source_attribute", "uid"
         )
 
+        self.saml2_idp_entityid = saml2_config.get("idp_entityid", None)
+
         # user_mapping_provider may be None if the key is present but has no value
         ump_dict = saml2_config.get("user_mapping_provider") or {}
 
@@ -350,6 +352,14 @@ def generate_config_section(self, config_dir_path, server_name, **kwargs):
           #    value: "staff"
           #  - attribute: department
           #    value: "sales"
+
+          # Most metadata XML only contains a single IdP entity. However if the
+          # metadata XML contains multiple IdPs Synapse needs to know which IdP to
+          # redirect users to. `idp_entityid` can be populated with the entity of
+          # the IdP that should be used. For most deployments, this parameter should
+          # be omitted.
+          #
+          #idp_entityid: 'https://our_idp/entityid'
         """ % {
             "config_dir_path": config_dir_path
         }

synapse/handlers/saml_handler.py

@@ -61,6 +61,7 @@ class SamlHandler:
     def __init__(self, hs: "synapse.server.HomeServer"):
         self.hs = hs
         self._saml_client = Saml2Client(hs.config.saml2_sp_config)
+        self._saml_idp_entityid = hs.config.saml2_idp_entityid
         self._auth = hs.get_auth()
         self._auth_handler = hs.get_auth_handler()
         self._registration_handler = hs.get_registration_handler()
@@ -124,7 +125,7 @@ def handle_redirect_request(
             URL to redirect to
         """
         reqid, info = self._saml_client.prepare_for_authenticate(
-            relay_state=client_redirect_url
+            entityid=self._saml_idp_entityid, relay_state=client_redirect_url
         )
 
         # Since SAML sessions timeout it is useful to log when they were created.