Multi tenant support with omniauth-multi-provider

[sbauch]

This PR adds SAML SSO support for multiple tenants where the SAML configuration data is hardcoded.

We use a few Ruby gems from the OmniAuth ecosystem to properly and securely handle SAML authentication.

• omniauth-saml handles the actual SAML request and response flow, using ruby-saml under the hood, much like we used in the Single Tenant branch.

• omniauth-multi-provider adds middleware that allows us to surface the correct SAML settings for a tenant and redirect the use to the correct SSO URL.

• omniauth-rails_csrf_protection helps us maintain security with regard to CVE-2015-9284.

We're only going to use POST requests with OmniAuth and need to protect those routes against CSRF. But we also need to disable CSRF protection for the SAML callback. Including the gem in your Gemfile adds middleware that will enforce POST requests with a valid authenticity token in OmniAuth routes. Then we disable the CSRF check for the saml callback - some IDPs will submit a POST request with www-url-form-encoded parameters, and we need to be able to handle those requests.

SAML Configuration

When configuring SAML SSO for a tenant, you must work with the tenant to configure your application to talk securely with their Identity Provider.

We use two tenants here, one with the domain example.com who is a "customer" of Osso's Mock IDP. Since this is a Mock IDP, there's no configuration required - the mock IDP is designed to take a valid SAMLRequest, allow a user to "sign in" with any email and password, and then redirects the user with a valid SAMLResponse.

The Mock IDP provides a federated metadata XML file that includes the SSO URL and x509 certificate that your application uses to send the user to the IDP login and to decode the SAMLResponse respectively. If you want to run this branch, you'll need to grab the x509 certificate string and stick it in your Rails credentials.

Our second tenant will be your company, and the guide uses Okta as the IDP for the second tenant - you can sign up for a free Okta developer account here: https://developer.okta.com/signup/

Sign in UX

We've updated our login form to be able to support both SAML logins and email / password logins. SAML SSO requires that we surface the correct SAML settings for a user, so we use a domain as a unique key to look up SAML configurations. A user can sign in with their email, and if we find a SAML tenant for that domain, we kick off the SAML flow. Otherwise we show a password field and leave the rest up to you.