SAML support (#3494)

* PLT-3073: Implement SAML/Okta Server side (EE) (#3422)

* PLT-3137 Support for SAML configuration

* PLT-3410 SAML Database Store

* PLT-3411 CLI to add Identity Provider Certificate and Service Provider Private Key

* PLT-3409 SAML Interface for EE

* PLT-3139 Handle SAML authentication server side

* Add localization messages

* PLT-3443 SAML Obtain SP metadata

* PLT-3142 Login & Switch to/from SAML

* Remove Certs for Database & Clean SAML Request

* Make required Username, FirstName and LastName

* PLT-3140 Add SAML to System Console (#3476)

* PLT-3140 Add SAML to System Console

* Move web_client functions to client.jsx

* Fix issues found by PM

* update package.json mattermost driver

* Fix text messages for SAML

1 files changed, 62 insertions, 1 deletions

diff --git a/webapp/i18n/en.json b/webapp/i18n/en.json
index 02d11e484..26b1b47fd 100644
--- a/webapp/i18n/en.json
+++ b/webapp/i18n/en.json
@@ -102,6 +102,7 @@
   "admin.audits.title": "User Activity Logs",
   "admin.authentication.email": "Email Auth",
   "admin.authentication.gitlab": "GitLab",
+  "admin.authentication.saml": "SAML",
   "admin.banner.heading": "Note:",
   "admin.compliance.directoryDescription": "Directory to which compliance reports are written. If blank, will be set to ./data/.",
   "admin.compliance.directoryExample": "Ex \"./data/\"",
@@ -217,6 +218,9 @@
   "admin.email.smtpUsernameTitle": "SMTP Server Username:",
   "admin.email.testing": "Testing...",
   "admin.false": "false",
+  "admin.file_upload.chooseFile": "Choose File",
+  "admin.file_upload.noFile": "No file uploaded",
+  "admin.file_upload.uploadFile": "Upload",
   "admin.files.images": "Images",
   "admin.files.storage": "Storage",
   "admin.general.configuration": "Configuration",
@@ -431,6 +435,58 @@
   "admin.reset_password.submit": "Please enter at least {chars} characters.",
   "admin.reset_password.titleReset": "Reset Password",
   "admin.reset_password.titleSwitch": "Switch Account to Email/Password",
+  "admin.saml.assertionConsumerServiceURLDesc": "Enter https://<your-mattermost-url>/login/sso/saml. Make sure you use HTTP or HTTPS in your URL depending on your server configuration. This field is also known as the Assertion Consumer Service URL.",
+  "admin.saml.assertionConsumerServiceURLEx": "Ex \"https://<your-mattermost-url>/login/sso/saml\"",
+  "admin.saml.assertionConsumerServiceURLTitle": "Service Provider Login URL:",
+  "admin.saml.emailAttrDesc": "The attribute in the SAML Assertion that will be used to populate the email addresses of users in Mattermost.",
+  "admin.saml.emailAttrEx": "Ex \"Email\" or \"PrimaryEmail\"",
+  "admin.saml.emailAttrTitle": "Email Attribute:",
+  "admin.saml.enableDescription": "When true, Mattermost allows login using SAML. Please see <a href='http://docs.mattermost.com/deployment/sso-saml.html' target='_blank'>documentation</a> to learn more about configuring SAML for Mattermost.",
+  "admin.saml.enableTitle": "Enable Login With SAML:",
+  "admin.saml.encryptDescription": "When true, Mattermost will decrypt SAML Assertions encrypted with your Service Provider Public Certificate.",
+  "admin.saml.encryptTitle": "Enable Encryption:",
+  "admin.saml.firstnameAttrDesc": "The attribute in the SAML Assertion that will be used to populate the first name of users in Mattermost.",
+  "admin.saml.firstnameAttrEx": "Ex \"FirstName\"",
+  "admin.saml.firstnameAttrTitle": "First Name Attribute:",
+  "admin.saml.idpCertificateFileDesc": "The public authentication certificate issued by your Identity Provider.",
+  "admin.saml.idpCertificateFileRemoveDesc": "Remove the public authentication certificate issued by your Identity Provider.",
+  "admin.saml.idpCertificateFileTitle": "Identity Provider Public Certificate:",
+  "admin.saml.idpDescriptorUrlDesc": "The issuer URL for the Identity Provider you use for SAML requests.",
+  "admin.saml.idpDescriptorUrlEx": "Ex \"https://idp.example.org/SAML2/issuer\"",
+  "admin.saml.idpDescriptorUrlTitle": "Identity Provider Issuer URL:",
+  "admin.saml.idpUrlDesc": "The URL where Mattermost sends a SAML request to start login sequence.",
+  "admin.saml.idpUrlEx": "Ex \"https://idp.example.org/SAML2/SSO/Login\"",
+  "admin.saml.idpUrlTitle": "SAML SSO URL:",
+  "admin.saml.lastnameAttrDesc": "The attribute in the SAML Assertion that will be used to populate the last name of users in Mattermost.",
+  "admin.saml.lastnameAttrEx": "Ex \"LastName\"",
+  "admin.saml.lastnameAttrTitle": "Last Name Attribute:",
+  "admin.saml.localeAttrDesc": "(Optional) The attribute in the SAML Assertion that will be used to populate the language of users in Mattermost.",
+  "admin.saml.localeAttrEx": "Ex \"Locale\" or \"PrimaryLanguage\"",
+  "admin.saml.localeAttrTitle": "Preferred Language Attribute:",
+  "admin.saml.loginButtonTextDesc": "(Optional) The text that appears in the login button on the login page. Defaults to \"With SAML\".",
+  "admin.saml.loginButtonTextEx": "Ex \"With OKTA\"",
+  "admin.saml.loginButtonTextTitle": "Login Button Text:",
+  "admin.saml.nicknameAttrDesc": "(Optional) The attribute in the SAML Assertion that will be used to populate the nickname of users in Mattermost.",
+  "admin.saml.nicknameAttrEx": "Ex \"Nickname\"",
+  "admin.saml.nicknameAttrTitle": "Nickname Attribute:",
+  "admin.saml.privateKeyFileFileDesc": "The private key used to decrypt SAML Assertions from the Identity Provider.",
+  "admin.saml.privateKeyFileFileRemoveDesc": "Remove the private key used to decrypt SAML Assertions from the Identity Provider.",
+  "admin.saml.privateKeyFileTitle": "Service Provider Private Key:",
+  "admin.saml.publicCertificateFileDesc": "The certificate used to generate the signature on a SAML request to the Identity Provider for a service provider initiated SAML login, when Mattermost is the Service Provider.",
+  "admin.saml.publicCertificateFileRemoveDesc": "Remove the certificate used to generate the signature on a SAML request to the Identity Provider for a service provider initiated SAML login, when Mattermost is the Service Provider.",
+  "admin.saml.publicCertificateFileTitle": "Service Provider Public Certificate:",
+  "admin.saml.remove.idp_certificate": "Remove Identity Provider Certificate",
+  "admin.saml.remove.privKey": "Remove Service Provider Private Key",
+  "admin.saml.remove.sp_certificate": "Remove Service Provider Certificate",
+  "admin.saml.removing.certificate": "Removing Certificate...",
+  "admin.saml.removing.privKey": "Removing Private Key...",
+  "admin.saml.uploading.certificate": "Uploading Certificate...",
+  "admin.saml.uploading.privateKey": "Uploading Private Key...",
+  "admin.saml.usernameAttrDesc": "The attribute in the SAML Assertion that will be used to populate the username field in Mattermost.",
+  "admin.saml.usernameAttrEx": "Ex \"Username\"",
+  "admin.saml.usernameAttrTitle": "Username Attribute:",
+  "admin.saml.verifyDescription": "When true, Mattermost verifies that the signature sent from the SAML Response matches the Service Provider Login URL",
+  "admin.saml.verifyTitle": "Verify Signature:",
   "admin.save": "Save",
   "admin.saving": "Saving Config...",
   "admin.security.connection": "Connections",
@@ -522,6 +578,7 @@
   "admin.sidebar.rateLimiting": "Rate Limiting",
   "admin.sidebar.reports": "REPORTING",
   "admin.sidebar.rmTeamSidebar": "Remove team from sidebar menu",
+  "admin.sidebar.saml": "SAML",
   "admin.sidebar.security": "Security",
   "admin.sidebar.sessions": "Sessions",
   "admin.sidebar.settings": "SETTINGS",
@@ -842,7 +899,7 @@
   "claim.ldap_to_email.title": "Switch LDAP Account to Email/Password",
   "claim.oauth_to_email.confirm": "Confirm Password",
   "claim.oauth_to_email.description": "Upon changing your account type, you will only be able to login with your email and password.",
-  "claim.oauth_to_email.enterNewPwd": "Enter a new password for your {site} account",
+  "claim.oauth_to_email.enterNewPwd": "Enter a new password for your {site} email account",
   "claim.oauth_to_email.enterPwd": "Please enter a password.",
   "claim.oauth_to_email.newPwd": "New Password",
   "claim.oauth_to_email.pwdNotMatch": "Password do not match.",
@@ -1454,6 +1511,7 @@
   "user.settings.general.emailHelp4": "A verification email was sent to {email}.",
   "user.settings.general.emailLdapCantUpdate": "Login occurs through LDAP. Email cannot be updated. Email address used for notifications is {email}.",
   "user.settings.general.emailMatch": "The new emails you entered do not match.",
+  "user.settings.general.emailSamlCantUpdate": "Login occurs through SAML. Email cannot be updated. Email address used for notifications is {email}.",
   "user.settings.general.emailUnchanged": "Your new email address is the same as your old email address.",
   "user.settings.general.emptyName": "Click 'Edit' to add your full name",
   "user.settings.general.emptyNickname": "Click 'Edit' to add a nickname",
@@ -1465,6 +1523,7 @@
   "user.settings.general.lastName": "Last Name",
   "user.settings.general.loginGitlab": "Login done through GitLab ({email})",
   "user.settings.general.loginLdap": "Login done through LDAP ({email})",
+  "user.settings.general.loginSaml": "Login done through SAML ({email})",
   "user.settings.general.newAddress": "New Address: {email}<br />Check your email to verify the above address.",
   "user.settings.general.nickname": "Nickname",
   "user.settings.general.nicknameExtra": "Use Nickname for a name you might be called that is different from your first name and username. This is most often used when two or more people have similar sounding names and usernames.",
@@ -1552,10 +1611,12 @@
   "user.settings.security.passwordLengthError": "New passwords must be at least {chars} characters",
   "user.settings.security.passwordMatchError": "The new passwords you entered do not match",
   "user.settings.security.retypePassword": "Retype New Password",
+  "user.settings.security.saml": "SAML",
   "user.settings.security.switchEmail": "Switch to using email and password",
   "user.settings.security.switchGitlab": "Switch to using GitLab SSO",
   "user.settings.security.switchGoogle": "Switch to using Google SSO",
   "user.settings.security.switchLdap": "Switch to using LDAP",
+  "user.settings.security.switchSaml": "Switch to using SAML SSO",
   "user.settings.security.title": "Security Settings",
   "user.settings.security.viewHistory": "View Access History",
   "user_list.notFound": "No users found",