saml: allow to keep existing roles on login (#3440)

src/Configuration/SamlConfiguration.php

@@ -46,6 +46,11 @@ final class SamlConfiguration implements SamlConfigurationInterface
         return $this->configuration->getSamlRolesMapping();
     }
 
+    public function isRolesResetOnLogin(): bool
+    {
+        return $this->configuration->isSamlRolesResetOnLogin();
+    }
+
     public function getConnection(): array
     {
         return $this->configuration->getSamlConnection();

src/Configuration/SamlConfigurationInterface.php

@@ -21,5 +21,7 @@ interface SamlConfigurationInterface
 
     public function getRolesMapping(): array;
 
+    public function isRolesResetOnLogin(): bool;
+
     public function getConnection(): array;
 }

src/Configuration/SystemConfiguration.php

@@ -86,6 +86,11 @@ class SystemConfiguration implements SystemBundleConfiguration
         return (array) $this->find('saml.roles.mapping');
     }
 
+    public function isSamlRolesResetOnLogin(): bool
+    {
+        return (bool) $this->find('saml.roles.resetOnLogin');
+    }
+
     public function getSamlConnection(): array
     {
         return (array) $this->find('saml.connection');

src/DependencyInjection/Configuration.php

@@ -885,6 +885,9 @@ class Configuration implements ConfigurationInterface
                 ->arrayNode('roles')
                     ->addDefaultsIfNotSet()
                     ->children()
+                        ->booleanNode('resetOnLogin')
+                            ->defaultTrue()
+                        ->end()
                         ->scalarNode('attribute')
                             ->defaultNull()
                         ->end()

src/Saml/User/SamlUserFactory.php

@@ -56,7 +56,13 @@ final class SamlUserFactory
                     $roles[] = $groupMap[$groupName];
                 }
             }
-            $user->setRoles($roles);
+            if ($this->configuration->isRolesResetOnLogin()) {
+                $user->setRoles($roles);
+            } else {
+                foreach ($roles as $role) {
+                    $user->addRole($role);
+                }
+            }
         }
 
         $mappingConfig = $this->configuration->getAttributeMapping();

tests/DependencyInjection/ConfigurationTest.php

@@ -451,6 +451,7 @@ class ConfigurationTest extends TestCase
                 'activate' => false,
                 'title' => 'Login with SAML',
                 'roles' => [
+                    'resetOnLogin' => true,
                     'attribute' => null,
                     'mapping' => []
                 ],