Enable LDAP and SAML authentication support

services/web/app/src/Features/Authentication/AuthenticationController.mjs

@@ -139,9 +139,9 @@ const AuthenticationController = {
     // so we can send back our custom `{message: {text: "", type: ""}}` responses on failure,
     // and send a `{redir: ""}` response on success
     passport.authenticate(
-      'local',
+      Settings.ldap?.enable ? ['custom-fail-ldapauth','local'] : ['local'],
       { keepSessionInfo: true },
-      async function (err, user, info) {
+      async function (err, user, infoArray) {
         if (err) {
           return next(err)
         }
@@ -163,6 +163,7 @@ const AuthenticationController = {
             return next(err)
           }
         } else {
+	  let info = infoArray[0]
           if (info.redir != null) {
             return res.json({ redir: info.redir })
           } else {

services/web/app/src/Features/PasswordReset/PasswordResetController.mjs

@@ -178,6 +178,10 @@ async function requestReset(req, res, next) {
     return res.status(404).json({
       message: req.i18n.translate('secondary_email_password_reset'),
     })
+  } else if (status === 'external') {
+    return res.status(403).json({
+      message: req.i18n.translate('password_managed_externally'),
+    })
   } else {
     return res.status(404).json({
       message: req.i18n.translate('cant_find_email'),

services/web/app/src/Features/PasswordReset/PasswordResetHandler.mjs

@@ -18,6 +18,10 @@ async function generateAndEmailResetToken(email) {
     return null
   }
 
+  if (!user.hashedPassword) {
+    return 'external'
+  }
+
   if (user.email !== email) {
     return 'secondary'
   }

services/web/app/src/Features/User/UserController.mjs

@@ -535,7 +535,7 @@ async function updateUserSettings(req, res, next) {
   if (
     newEmail == null ||
     newEmail === user.email ||
-    req.externalAuthenticationSystemUsed()
+    (req.externalAuthenticationSystemUsed() && !user.hashedPassword)
   ) {
     // end here, don't update email
     SessionManager.setInSessionUser(req.session, {
@@ -628,6 +628,7 @@ const logoutSchema = z.object({
 })
 
 async function logout(req, res, next) {
+  if (req?.session.saml_extce) return res.redirect(308, '/saml/logout')
   const { body } = parseReq(req, logoutSchema, { logOnly: true })
   const requestedRedirect = body.redirect
     ? UrlHelper.getSafeRedirectPath(body.redirect)