Switch shibboleth from shibboleth to okta

[britaumich]

PR switches authentication from Shibboleth to Okta and addresses some problems that happened when I cloned the repo to install the application.

1. The development, staging, and production apps were created for MClassrooms in the Application Management and Provisioning (AMP) Application, and generated metadata was used to update the devise initializer and credentials file.

Test signing in on localhost can be done now; the staging and production servers can be tested after the PR is merged.

2. What else was changed in this PR?

I cloned the lsa_evaluate repo to have a clean installation of the application.

• I got the following error when starting the Rails console:

bin/rails c
Loading development environment (Rails 8.1.3.1)
Sorry, you can't use Pry without Readline or a compatible library.  
 * Use the rb-readline gem, which is a pure-Ruby port of Readline 

Adding the pry gem and updating the pry-rails gem fixed the problem

• Okta Attributes Released has a displayName attribute but no name attribute. The following files were edited to address the change:

app/controllers/users/omniauth_callbacks_controller.rb
config/initializers/devise.rb
spec/requests/users/omniauth_callbacks_spec.rb
spec/support/auth_helpers.rb

[Copilot]

Copilot review overview

🟡 Changes recommended

Critical attribute handling and test coverage issues, plus missing RelayState preservation, remain unresolved.

Get a fresh assessment by requesting another Copilot review.

Review effort: Lite
Findings: 2

Open (2)

• Update SAML fixtures and assertions for new attribute names · New
• Use normalized SAML info values when building user parameters · New

What changed in this PR

Switches SAML authentication from Shibboleth to Okta and updates identity attribute handling.

Changes:

• Configures Okta SAML endpoints, certificates, and mappings.
• Updates callback identity extraction.
• Adds rb-readline and updates encrypted credentials.

File	Summary
Gemfile	Adds rb-readline.
Gemfile.lock	Locks the new dependency.
config/​initializers/​devise.rb	Updates Okta SAML configuration; raw attribute handling and RelayState preservation require changes.
config/​credentials.yml.enc	Updates encrypted SAML credentials.
app/​controllers/​users/​omniauth_callbacks_controller.rb	Updates Okta identity extraction; fixtures and assertions require updates.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Copilot review overview

🟡 Changes recommended

Inconsistent Okta attribute mappings can reject all logins and discard user data.

Review effort: Lite
Findings: 3

Open (3)

• Update callback fields to use consistent Okta attribute mappings · New
• Use normalized SAML info values when building user parameters
• Update SAML fixtures and assertions for new attribute names

Previously missed (1)

In code that hasn't changed since last review

Preserve RelayState runtime mapping for deep-link redirects

config/​initializers/​devise.rb:308

This removes the existing idp_sso_service_url_runtime_params: { origin: :RelayState } mapping. Both login buttons pass saml_authorize_params, and ApplicationController#after_sign_in_path_for relies on the resulting RelayState to restore encrypted deep links; without this mapping, users who start from a private/deep link lose that destination after Okta login and fall back to the default path. Retain the runtime-parameter mapping.

[Copilot]

Copilot review overview

🟡 Changes recommended

Moderate issues remain in SAML configuration and callback test coverage.

Review effort: Lite
Findings: 1

Open (1)

• Add test coverage for Okta uid and principal_name mappings · New

Resolved since last review (3)

• Update callback fields to use consistent Okta attribute mappings
• Use normalized SAML info values when building user parameters
• Update SAML fixtures and assertions for new attribute names

Previously missed (2)

In code that hasn't changed since last review

Restore RelayState mapping for deep-link redirects

config/​initializers/​devise.rb:310

saml_authorize_params sends the encrypted deep-link in an origin request parameter, but the new options no longer map that parameter to SAML RelayState. As a result, the IdP callback will not carry the /c/:token (or other deep-link) destination and after_sign_in_path_for falls back to the default dashboard/root path. Restore the runtime parameter mapping used by the previous configuration.

Preserve 10-second SAML clock drift tolerance

config/​initializers/​devise.rb:314

The previous configuration explicitly allowed 10 seconds of SAML clock skew, but this rewrite removes allowed_clock_drift. ruby-saml defaults this tolerance to zero, so ordinary small clock differences between the app and Okta can make otherwise valid assertions fail their time validation. Keep the existing 10-second tolerance (or replace it with an explicitly chosen nonzero value).

[Copilot]

Copilot review overview

🔵 Needs a closer look

Authentication configuration has unresolved issues affecting clock tolerance, deep-link redirects, and email mapping.

Review effort: Lite
Findings: None

Resolved since last review (1)

• Add test coverage for Okta uid and principal_name mappings

Previously missed (2)

In code that hasn't changed since last review

Preserve RelayState origin mapping for deep-link redirects

config/​initializers/​devise.rb:310

This removes the runtime mapping that carries the origin parameter from the sign-in buttons into SAML RelayState. ApplicationController#after_sign_in_path_for relies on that opaque RelayState to restore session['user_return_to'] (including /c/:token invite links), so a deep-link login will now fall back to the role-based destination instead of returning to the requested page. Preserve the mapping here.

Preserve SAML clock drift allowance

config/​initializers/​devise.rb:314

The previous SAML configuration explicitly allowed 10 seconds of IdP/SP clock skew, but this replacement drops allowed_clock_drift. ruby-saml defaults this to zero, so normal clock differences can cause otherwise valid Okta assertions to be rejected for timestamp validation; retain the explicit allowance (or another reviewed value).

[Copilot]

🟡 Changes recommended

Restore runtime relay-state handling and align the Okta email attribute mapping.

1 open finding

• Map Okta email to eduPersonPrincipalName attribute · New

Previously missed (1)

In code that hasn't changed since last review

Restore SAML RelayState runtime parameter mapping

config/​initializers/​devise.rb:315

The previous SAML configuration mapped the origin query parameter to RelayState, but this replacement drops idp_sso_service_url_runtime_params. The login buttons still send the opaque return path via saml_authorize_params, so without this mapping the IdP will not return it and deep links such as contest invite URLs fall back to the default post-login page. Restore the runtime-parameter mapping here.

🧠 Review effort: Lite