From 484e4896de75dc9eea01b9bd11bc3a34f9cea346 Mon Sep 17 00:00:00 2001
From: Dante Catalfamo <43040593+dantecatalfamo@users.noreply.github.com>
Date: Thu, 17 Jul 2025 14:25:33 -0400
Subject: [PATCH] Make sure SAML requests always ask for email format NameID
 (#31008)

#30978
---
 ee/server/service/mdm.go                 | 3 ---
 ee/server/service/users.go               | 2 +-
 server/sso/authorization_request_test.go | 1 +
 server/sso/saml_provider.go              | 7 ++++---
 4 files changed, 6 insertions(+), 7 deletions(-)

diff --git a/ee/server/service/mdm.go b/ee/server/service/mdm.go
index 5fa06297af..df90777ec9 100644
--- a/ee/server/service/mdm.go
+++ b/ee/server/service/mdm.go
@@ -15,7 +15,6 @@ import (
 	"sort"
 	"strings"
 
-	"github.com/crewjam/saml"
 	"github.com/fleetdm/fleet/v4/pkg/file"
 	"github.com/fleetdm/fleet/v4/pkg/optjson"
 	"github.com/fleetdm/fleet/v4/server/authz"
@@ -721,8 +720,6 @@ func (svc *Service) InitiateMDMAppleSSO(ctx context.Context, initiator string) (
 	if err != nil {
 		return "", 0, "", ctxerr.Wrap(ctx, err, "failed to create provider from metadata")
 	}
-	// Request the NameID as an email address instead of an unknown type
-	samlProvider.AuthnNameIDFormat = saml.EmailAddressNameIDFormat
 
 	// originalURL is unused in the Setup Experience initiated MDM flow
 	// however because we need slightly different behavior for account driven
diff --git a/ee/server/service/users.go b/ee/server/service/users.go
index 15a413a16d..7527b75014 100644
--- a/ee/server/service/users.go
+++ b/ee/server/service/users.go
@@ -22,7 +22,7 @@ func (svc *Service) GetSSOUser(ctx context.Context, auth fleet.Auth) (*fleet.Use
 	// email, we do it here to avoid hitting the database early if
 	// the email happens to be invalid.
 	if err := fleet.ValidateEmail(auth.UserID()); err != nil {
-		return nil, ctxerr.New(ctx, "validating SSO response")
+		return nil, ctxerr.Wrap(ctx, err, "validating SSO response email")
 	}
 
 	user, err := svc.Service.GetSSOUser(ctx, auth)
diff --git a/server/sso/authorization_request_test.go b/server/sso/authorization_request_test.go
index f9de538099..f90ca088ad 100644
--- a/server/sso/authorization_request_test.go
+++ b/server/sso/authorization_request_test.go
@@ -61,6 +61,7 @@ func TestCreateAuthorizationRequest(t *testing.T) {
 	authReq := inflate(t, encoded)
 	assert.Equal(t, "issuer", authReq.Issuer.Value)
 	assert.Equal(t, "Fleet", authReq.ProviderName)
+	assert.Equal(t, string(saml.EmailAddressNameIDFormat), authReq.NameIDPolicy.Element().Attr[0].Value)
 	assert.True(t, strings.HasPrefix(authReq.ID, "id"), authReq.ID)
 
 	ssn := store.session
diff --git a/server/sso/saml_provider.go b/server/sso/saml_provider.go
index abe93b77c1..cfdb0d64ce 100644
--- a/server/sso/saml_provider.go
+++ b/server/sso/saml_provider.go
@@ -48,9 +48,10 @@ func SAMLProviderFromConfiguredMetadata(
 		return nil, ctxerr.Wrap(ctx, err, "failed to parse ACS URL")
 	}
 	return &saml.ServiceProvider{
-		EntityID:    entityID,
-		AcsURL:      *parsedACSURL,
-		IDPMetadata: entityDescriptor,
+		EntityID:          entityID,
+		AcsURL:            *parsedACSURL,
+		IDPMetadata:       entityDescriptor,
+		AuthnNameIDFormat: saml.EmailAddressNameIDFormat,
 	}, nil
 }