From b6b0c269c4627fcc53faa91872a47f275e76a0eb Mon Sep 17 00:00:00 2001
From: Ben Cooke <benkcooke@gmail.com>
Date: Mon, 12 May 2025 23:41:54 +0100
Subject: [PATCH] Use error from OnSamlLogin (#30745)

---
 server/channels/web/saml.go | 10 ++++++++--
 server/i18n/en.json         |  4 ++++
 2 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/server/channels/web/saml.go b/server/channels/web/saml.go
index 8b2594e25c..632ef7e323 100644
--- a/server/channels/web/saml.go
+++ b/server/channels/web/saml.go
@@ -182,10 +182,16 @@ func completeSaml(c *Context, w http.ResponseWriter, r *http.Request) {
 		AcceptLanguage: c.AppContext.AcceptLanguage(),
 		UserAgent:      c.AppContext.UserAgent(),
 	}
+
+	var hookErr error
 	c.App.Channels().RunMultiHook(func(hooks plugin.Hooks, manifest *model.Manifest) bool {
-		err := hooks.OnSAMLLogin(pluginContext, user, assertion)
-		return err == nil
+		hookErr = hooks.OnSAMLLogin(pluginContext, user, assertion)
+		return hookErr == nil
 	}, plugin.OnSAMLLoginID)
+	if hookErr != nil {
+		handleError(model.NewAppError("completeSaml", "api.user.authorize_oauth_user.saml_hook_error.app_error", nil, "", http.StatusInternalServerError).Wrap(hookErr))
+		return
+	}
 
 	auditRec.AddMeta("obtained_user_id", user.Id)
 	c.LogAuditWithUserId(user.Id, "obtained user")
diff --git a/server/i18n/en.json b/server/i18n/en.json
index 81d736699f..910b026d36 100644
--- a/server/i18n/en.json
+++ b/server/i18n/en.json
@@ -3922,6 +3922,10 @@
     "id": "api.user.authorize_oauth_user.response.app_error",
     "translation": "Received invalid response from OAuth service provider."
   },
+  {
+    "id": "api.user.authorize_oauth_user.saml_hook_error.app_error",
+    "translation": "An error occurred in the OnSamlLogin hook. Please contact your System Administrator."
+  },
   {
     "id": "api.user.authorize_oauth_user.saml_response_too_long.app_error",
     "translation": "SAML response is too long"