From 95ab9bda2d4d3c8c86e42b58d03e2d4d3d2904aa Mon Sep 17 00:00:00 2001
From: Kevin Papst <kevinpapst@users.noreply.github.com>
Date: Tue, 26 Jul 2022 23:18:04 +0200
Subject: [PATCH] saml: allow to keep existing roles on login (#3440)

---
 src/Configuration/SamlConfiguration.php          | 5 +++++
 src/Configuration/SamlConfigurationInterface.php | 2 ++
 src/Configuration/SystemConfiguration.php        | 5 +++++
 src/DependencyInjection/Configuration.php        | 3 +++
 src/Saml/User/SamlUserFactory.php                | 8 +++++++-
 tests/DependencyInjection/ConfigurationTest.php  | 1 +
 6 files changed, 23 insertions(+), 1 deletion(-)

diff --git a/src/Configuration/SamlConfiguration.php b/src/Configuration/SamlConfiguration.php
index 8284f22a..950bc1f7 100644
--- a/src/Configuration/SamlConfiguration.php
+++ b/src/Configuration/SamlConfiguration.php
@@ -46,6 +46,11 @@ final class SamlConfiguration implements SamlConfigurationInterface
         return $this->configuration->getSamlRolesMapping();
     }
 
+    public function isRolesResetOnLogin(): bool
+    {
+        return $this->configuration->isSamlRolesResetOnLogin();
+    }
+
     public function getConnection(): array
     {
         return $this->configuration->getSamlConnection();
diff --git a/src/Configuration/SamlConfigurationInterface.php b/src/Configuration/SamlConfigurationInterface.php
index 3af1fe59..4fd76c30 100644
--- a/src/Configuration/SamlConfigurationInterface.php
+++ b/src/Configuration/SamlConfigurationInterface.php
@@ -21,5 +21,7 @@ interface SamlConfigurationInterface
 
     public function getRolesMapping(): array;
 
+    public function isRolesResetOnLogin(): bool;
+
     public function getConnection(): array;
 }
diff --git a/src/Configuration/SystemConfiguration.php b/src/Configuration/SystemConfiguration.php
index 8afbaf58..04b4a361 100644
--- a/src/Configuration/SystemConfiguration.php
+++ b/src/Configuration/SystemConfiguration.php
@@ -86,6 +86,11 @@ class SystemConfiguration implements SystemBundleConfiguration
         return (array) $this->find('saml.roles.mapping');
     }
 
+    public function isSamlRolesResetOnLogin(): bool
+    {
+        return (bool) $this->find('saml.roles.resetOnLogin');
+    }
+
     public function getSamlConnection(): array
     {
         return (array) $this->find('saml.connection');
diff --git a/src/DependencyInjection/Configuration.php b/src/DependencyInjection/Configuration.php
index d6f6e33c..f75f7dfb 100644
--- a/src/DependencyInjection/Configuration.php
+++ b/src/DependencyInjection/Configuration.php
@@ -885,6 +885,9 @@ class Configuration implements ConfigurationInterface
                 ->arrayNode('roles')
                     ->addDefaultsIfNotSet()
                     ->children()
+                        ->booleanNode('resetOnLogin')
+                            ->defaultTrue()
+                        ->end()
                         ->scalarNode('attribute')
                             ->defaultNull()
                         ->end()
diff --git a/src/Saml/User/SamlUserFactory.php b/src/Saml/User/SamlUserFactory.php
index 35003f4f..b236851d 100644
--- a/src/Saml/User/SamlUserFactory.php
+++ b/src/Saml/User/SamlUserFactory.php
@@ -56,7 +56,13 @@ final class SamlUserFactory
                     $roles[] = $groupMap[$groupName];
                 }
             }
-            $user->setRoles($roles);
+            if ($this->configuration->isRolesResetOnLogin()) {
+                $user->setRoles($roles);
+            } else {
+                foreach ($roles as $role) {
+                    $user->addRole($role);
+                }
+            }
         }
 
         $mappingConfig = $this->configuration->getAttributeMapping();
diff --git a/tests/DependencyInjection/ConfigurationTest.php b/tests/DependencyInjection/ConfigurationTest.php
index e751f218..b8da8e5b 100644
--- a/tests/DependencyInjection/ConfigurationTest.php
+++ b/tests/DependencyInjection/ConfigurationTest.php
@@ -451,6 +451,7 @@ class ConfigurationTest extends TestCase
                 'activate' => false,
                 'title' => 'Login with SAML',
                 'roles' => [
+                    'resetOnLogin' => true,
                     'attribute' => null,
                     'mapping' => []
                 ],