MM-18013 Allow configuration of SAML crypto hashing algorithms (#12362)

* MM-18013 Add SAML Algorithms to config.

* set defaults to current values, add validation for settings

* update to use simplier config entry

model/config_test.go

@@ -95,6 +95,106 @@ func TestConfigDefaultFileSettingsS3SSE(t *testing.T) {
 	}
 }
 
+func TestConfigDefaultSignatureAlgorithm(t *testing.T) {
+	c1 := Config{}
+	c1.SetDefaults()
+
+	if *c1.SamlSettings.SignatureAlgorithm != SAML_SETTINGS_DEFAULT_SIGNATURE_ALGORITHM {
+		t.Fatal("SamlSettings.SignatureAlgorithm default not set")
+	}
+
+	if *c1.SamlSettings.DigestAlgorithm != SAML_SETTINGS_DEFAULT_DIGEST_ALGORITHM {
+		t.Fatal("SamlSettings.DigestAlgorithm default not set")
+	}
+	if *c1.SamlSettings.CanonicalAlgorithm != SAML_SETTINGS_DEFAULT_CANONICAL_ALGORITHM {
+		t.Fatal("SamlSettings.CanonicalAlgorithm default not set")
+	}
+}
+
+func TestConfigOverwriteSignatureAlgorithm(t *testing.T) {
+	const testAlgorithm = "FakeAlgorithm"
+	c1 := Config{
+		SamlSettings: SamlSettings{
+			CanonicalAlgorithm: NewString(testAlgorithm),
+			SignatureAlgorithm: NewString(testAlgorithm),
+			DigestAlgorithm:    NewString(testAlgorithm),
+		},
+	}
+
+	c1.SetDefaults()
+
+	if *c1.SamlSettings.SignatureAlgorithm != testAlgorithm {
+		t.Fatal("SamlSettings.SignatureAlgorithm should be overwritten")
+	}
+	if *c1.SamlSettings.DigestAlgorithm != testAlgorithm {
+		t.Fatal("SamlSettings.DigestAlgorithm should be overwritten")
+	}
+	if *c1.SamlSettings.CanonicalAlgorithm != testAlgorithm {
+		t.Fatal("SamlSettings.CanonicalAlgorithm should be overwritten")
+	}
+}
+
+func TestConfigIsValidDefaultAlgorithms(t *testing.T) {
+	c1 := Config{}
+	c1.SetDefaults()
+
+	*c1.SamlSettings.Enable = true
+	*c1.SamlSettings.Verify = false
+	*c1.SamlSettings.Encrypt = false
+
+	*c1.SamlSettings.IdpUrl = "http://test.url.com"
+	*c1.SamlSettings.IdpDescriptorUrl = "http://test.url.com"
+	*c1.SamlSettings.IdpCertificateFile = "certificatefile"
+	*c1.SamlSettings.EmailAttribute = "Email"
+	*c1.SamlSettings.UsernameAttribute = "Username"
+
+	err := c1.SamlSettings.isValid()
+	if err != nil {
+		t.Fatal("SAMLSettings validation should pass with default settings")
+	}
+}
+
+func TestConfigIsValidFakeAlgorithm(t *testing.T) {
+	c1 := Config{}
+	c1.SetDefaults()
+
+	*c1.SamlSettings.Enable = true
+	*c1.SamlSettings.Verify = false
+	*c1.SamlSettings.Encrypt = false
+
+	*c1.SamlSettings.IdpUrl = "http://test.url.com"
+	*c1.SamlSettings.IdpDescriptorUrl = "http://test.url.com"
+	*c1.SamlSettings.IdpCertificateFile = "certificatefile"
+	*c1.SamlSettings.EmailAttribute = "Email"
+	*c1.SamlSettings.UsernameAttribute = "Username"
+
+	temp := *c1.SamlSettings.CanonicalAlgorithm
+	*c1.SamlSettings.CanonicalAlgorithm = "Fake Algorithm"
+	err := c1.SamlSettings.isValid()
+	if err == nil {
+		t.Fatal("SAMLSettings validation should fail with fake Canonical Algorithm")
+	}
+	require.Equal(t, "model.config.is_valid.saml_canonical_algorithm.app_error", err.Message)
+	*c1.SamlSettings.CanonicalAlgorithm = temp
+
+	temp = *c1.SamlSettings.DigestAlgorithm
+	*c1.SamlSettings.DigestAlgorithm = "Fake Algorithm"
+	err = c1.SamlSettings.isValid()
+	if err == nil {
+		t.Fatal("SAMLSettings validation should pass fake digest Algorithm")
+	}
+	require.Equal(t, "model.config.is_valid.saml_digest_algorithm.app_error", err.Message)
+	*c1.SamlSettings.DigestAlgorithm = temp
+
+	temp = *c1.SamlSettings.SignatureAlgorithm
+	*c1.SamlSettings.SignatureAlgorithm = "Fake Algorithm"
+	err = c1.SamlSettings.isValid()
+	if err == nil {
+		t.Fatal("SAMLSettings validation should pass with fake signature settings")
+	}
+	require.Equal(t, "model.config.is_valid.saml_signature_algorithm.app_error", err.Message)
+}
+
 func TestConfigDefaultServiceSettingsExperimentalGroupUnreadChannels(t *testing.T) {
 	c1 := Config{}
 	c1.SetDefaults()