Remove default role configuration

Signed-off-by: Bryan Frimin <bryan@getprobo.com>

pkg/auth/saml_configuration_service.go

@@ -38,7 +38,6 @@ type (
 		AttributeFirstname string
 		AttributeLastname  string
 		AttributeRole      string
-		DefaultRole        string
 		AutoSignupEnabled  bool
 	}
 
@@ -54,7 +53,6 @@ type (
 		AttributeFirstname *string
 		AttributeLastname  *string
 		AttributeRole      *string
-		DefaultRole        *string
 		AutoSignupEnabled  *bool
 	}
 )
@@ -64,18 +62,8 @@ func (s TenantAuthService) CreateSAMLConfiguration(
 	req CreateSAMLConfigurationRequest,
 ) (*coredata.SAMLConfiguration, error) {
 	// Validate only the IdP configuration (user-provided data)
-	validationErrors := ValidateIdPConfiguration(
-		req.IdPEntityID,
-		req.IdPSsoURL,
-		req.IdPCertificate,
-	)
-
-	if len(validationErrors) > 0 {
-		var errMsgs []string
-		for _, err := range validationErrors {
-			errMsgs = append(errMsgs, err.Error())
-		}
-		return nil, fmt.Errorf("SAML configuration validation failed: %s", strings.Join(errMsgs, "; "))
+	if err := ValidateIdPConfiguration(req.IdPEntityID, req.IdPSsoURL, req.IdPCertificate); err != nil {
+		return nil, fmt.Errorf("SAML configuration validation failed: %w", err)
 	}
 
 	var config *coredata.SAMLConfiguration
@@ -105,7 +93,6 @@ func (s TenantAuthService) CreateSAMLConfiguration(
 				AttributeFirstname: req.AttributeFirstname,
 				AttributeLastname:  req.AttributeLastname,
 				AttributeRole:      req.AttributeRole,
-				DefaultRole:        req.DefaultRole,
 				AutoSignupEnabled:  req.AutoSignupEnabled,
 				CreatedAt:          now,
 				UpdatedAt:          now,
@@ -169,9 +156,6 @@ func (s TenantAuthService) UpdateSAMLConfiguration(
 			if req.AttributeRole != nil {
 				cfg.AttributeRole = *req.AttributeRole
 			}
-			if req.DefaultRole != nil {
-				cfg.DefaultRole = *req.DefaultRole
-			}
 			if req.AutoSignupEnabled != nil {
 				cfg.AutoSignupEnabled = *req.AutoSignupEnabled
 			}

pkg/auth/saml_mapper.go

@@ -74,16 +74,13 @@ func ExtractEmailDomain(email string) (string, error) {
 	return domain, nil
 }
 
-func MapSAMLRoleToSystemRole(samlRole string, defaultRole string) (string, error) {
+func MapSAMLRoleToSystemRole(samlRole string) string {
 	if samlRole != "" && isValidRole(samlRole) {
-		return samlRole, nil
+		return samlRole
 	}
 
-	if !isValidRole(defaultRole) {
-		return "", fmt.Errorf("invalid default role %q", defaultRole)
-	}
-
-	return defaultRole, nil
+	// Default to MEMBER role if SAML role is missing or invalid
+	return "MEMBER"
 }
 
 func isValidRole(role string) bool {

pkg/auth/saml_service.go

@@ -547,10 +547,7 @@ func (s *SAMLService) HandleSAMLAssertion(
 		return nil, fmt.Errorf("email domain mismatch: assertion contains email with domain %s but SAML config is for domain %s", actualEmailDomain, config.EmailDomain)
 	}
 
-	systemRole, err := MapSAMLRoleToSystemRole(samlRole, config.DefaultRole)
-	if err != nil {
-		return nil, ErrCannotMapRole{Err: err}
-	}
+	systemRole := MapSAMLRoleToSystemRole(samlRole)
 
 	samlSubject := ""
 	if assertion.Subject != nil && assertion.Subject.NameID != nil {

pkg/auth/service.go

@@ -1155,7 +1155,6 @@ func (s Service) InitiateDomainVerification(
 			AttributeFirstname: "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname",
 			AttributeLastname:  "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname",
 			AttributeRole:      "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/role",
-			DefaultRole:        "MEMBER",
 			AutoSignupEnabled:  false,
 			CreatedAt:          now,
 			UpdatedAt:          now,