mirror of
https://github.com/mattermost/mattermost.git
synced 2026-11-02 20:31:01 -06:00
9b1c4fd558
* [MM-71057] Add health rules for auth and identity Port the script's LDAP, SAML and session checks as rules in a new rules/auth package, plus two probe rules over the leader's LDAP and SAML connection tests. Each code emits one result per cycle: unknown when its config is missing, resolved when its gate (LDAP, LDAP sync or SAML) is closed. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Co-authored-by: Cursor <cursoragent@cursor.com> * [MM-71057] Cover the auth rules in the packet fixtures The fixture configs had no LdapSettings or SamlSettings, so every auth rule read unknown. The standalone packet now models an upgraded install without AD/LDAP or SAML; the HA packet uses SAML sign-in with AD/LDAP sync only, with matching probe results in each node's diagnostics. The mmctl --packet test packet gains the settings and user count the auth rules read, so its expected output is unchanged. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Co-authored-by: Cursor <cursoragent@cursor.com> * [MM-71057] Use shared unknown reasons, raise SAML_VERIFY_OFF to warning The probe rules, LDAP_RECOMMENDED_AT_SCALE and LDAP_SYNC_DUTY_CYCLE now report a missing source with the shared diagnostics, stats and jobs reasons instead of per-code ids. Only the duty cycle's "no measurable run" message stays per code. With Verify off, the SAML response signature is not validated, so a forged response is accepted; that warrants warning rather than info. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Co-authored-by: Cursor <cursoragent@cursor.com> * [MM-71057] Fold the auth probe evals into one helper Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * [MM-71057] Skip auth rules for settings that have no effect SAML_SIGNATURE_SHA1 now requires SignRequest, LDAP_SKIP_CERT requires TLS or STARTTLS, SAML IdAttribute matching handles claim URIs, and ldapEnabled no longer needs EnableSync when Enable is already true. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * [MM-71057] Tone down the LDAP sync duty cycle message Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * [MM-71057] Evaluate the LDAP and SAML rules on Cloud Cloud admins can change these settings, unlike the cloud_restrictable ones or the pages RestrictSystemAdmin hides. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * Keep the mmctl packet fixture under the AD/LDAP recommendation threshold The fixture's 300 users made LDAP_RECOMMENDED_AT_SCALE fire, adding an unexpected finding to the packet output tests. * Address review on the auth health rules - SAML_VERIFY_OFF is critical: with Verify off the SP skips signature validation, so a self-made response to the ACS URL signs in as anyone. - SAML_METADATA_UNREACHABLE becomes SAML_PROBE_FAILED, gated only on SAML being enabled. MM-71043 changes the probe to check the IdP certificate and IdP URL that sign-in uses instead of IdpMetadataURL. - LDAP_SYNC_DUTY_CYCLE only averages success and warning runs; running, canceled and failed runs end early and understate the load. - SAML_ID_IS_EMAIL is info, since it fires on every default SAML install, and the remediation says accounts migrate at next sign-in. - LDAP_RECOMMENDED_AT_SCALE resolves for GitLab, Google, Office 365 and OpenID too. - SAML_ID_MUTABLE also matches upn, userprincipalname and name (Entra's UPN claim). - LDAP_SYNC_INTERVAL_LOW is removed; LDAP_SYNC_DUTY_CYCLE measures the actual load for short intervals. * Simplify the auth rule test helpers Drop the single-use codes() helper, read LDAP_RECOMMENDED_AT_SCALE's state directly, and reuse configSnapshot's sections in probeSnapshot and gateSnapshot. Note why leaderProbe skips the probe section errors that its siblings check. * Tighten LDAP_RECOMMENDED_AT_SCALE and the probe rules - Count active users, not registered ones, which include deactivated accounts. - Sync-only LDAP no longer counts as SSO: it signs no one in, so those users still have local passwords. - An enabled provider resolves the rule even if another provider's setting is missing from the config. - The probe rules resolve only on OK. A disabled status while the gate is open means the leader never ran the probe, so it is unknown. - assertResults fails on a code that is not in allRules instead of skipping it. - The standalone fixture gains the GitLab, Google, Office 365 and OpenID sections a real packet always has. --------- Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Co-authored-by: Cursor <cursoragent@cursor.com>
Mattermost is an open core, self-hosted collaboration platform that offers chat, workflow automation, voice calling, screen sharing, and AI integration. This repo is the primary source for core development on the Mattermost platform; it's written in Go and React, runs as a single Linux binary, and relies on PostgreSQL. A new compiled version is released under an MIT license every month on the 16th.
Deploy Mattermost on-premises, or try it for free in the cloud.
Learn more about the following use cases with Mattermost:
Other useful resources:
- Download and Install Mattermost - Install, setup, and configure your own Mattermost instance.
- Product documentation - Learn how to run a Mattermost instance and take advantage of all the features.
- Developer documentation - Contribute code to Mattermost or build an integration via APIs, Webhooks, slash commands, Apps, and plugins.
Table of contents
- Install Mattermost
- Native mobile and desktop apps
- Get security bulletins
- Get involved
- Learn more
- License
- Get the latest news
- Contributing
Install Mattermost
- Download and Install Mattermost Self-Hosted - Deploy a Mattermost Self-hosted instance in minutes via Docker, Ubuntu, or tar.
- Get started in the cloud to try Mattermost today.
- Developer machine setup - Follow this guide if you want to write code for Mattermost.
Other install guides:
- Deploy Mattermost on Docker
- Mattermost Omnibus
- Install Mattermost from Tar
- Ubuntu 20.04 LTS
- Kubernetes
- Helm
- More server install guides
Native mobile and desktop apps
In addition to the web interface, you can also download Mattermost clients for Android, iOS, Windows PC, macOS, and Linux.
Get security bulletins
Receive notifications of critical security updates. The sophistication of online attackers is perpetually increasing. If you're deploying Mattermost it's highly recommended you subscribe to the Mattermost Security Bulletin mailing list for updates on critical security releases.
Get involved
- Contribute to Mattermost
- Find "Help Wanted" projects
- Join Developer Discussion on a Mattermost server for contributors
- Get Help With Mattermost
Learn more
- API options - webhooks, slash commands, drivers, and web service
- See who's using Mattermost
- Browse over 700 Mattermost integrations
License
See the LICENSE file for license rights and limitations.
Get the latest news
- X - Follow Mattermost on X, formerly Twitter.
- Blog - Get the latest updates from the Mattermost blog.
- Facebook - Follow Mattermost on Facebook.
- LinkedIn - Follow Mattermost on LinkedIn.
- Email - Subscribe to our newsletter (1 or 2 per month).
- Mattermost - Join the ~contributors channel on the Mattermost Community Server.
- IRC - Join the #matterbridge channel on Freenode (thanks to matterircd).
- YouTube - Subscribe to Mattermost.
Contributing
Please see CONTRIBUTING.md. Join the Mattermost Contributors server to join community discussions about contributions, development, and more.