Merge ~pjdc/charm-k8s-mattermost/+git/charm-k8s-mattermost:add-saml-library-config into charm-k8s-mattermost:master

[Paul Collins]

add use_experimental_saml_library, defaulting to true for backward-compatibility

[🤖 Canonical IS Merge Bot (canonical-is-mergebot)]

This merge proposal is being monitored by mergebot. Change the status to Approved to merge.

[Barry Price (barryprice)]

+1

review: Approve

[🤖 Canonical IS Merge Bot (canonical-is-mergebot)]

Change successfully merged at revision e1c4c9c7bd671382239c420f91254b946594e8b6

diff --git a/config.yaml b/config.yaml
index 5e8d551..22f73af 100644
--- a/config.yaml
+++ b/config.yaml
@@ -186,3 +186,8 @@ options:
         description: |
           If set, apply miscellaneous Mattermost settings as used by Canonical.
         default: false
+    use_experimental_saml_library:
+        type: boolean
+        description: |
+          If set, use the built-in Mattermost SAML library. Otherwise, use xmlsec1 to verify logins.
+        default: true
diff --git a/src/charm.py b/src/charm.py
index 5d4446e..285d8e2 100755
--- a/src/charm.py
+++ b/src/charm.py
@@ -427,7 +427,8 @@ class MattermostK8sCharm(CharmBase):
             return
         site_hostname = urlparse(config['site_url']).hostname
 
-        get_env_config(pod_spec, self.app.name).update(
+        env_config = get_env_config(pod_spec, self.app.name)
+        env_config.update(
             {
                 'MM_EMAILSETTINGS_ENABLESIGNINWITHEMAIL': 'false',
                 'MM_EMAILSETTINGS_ENABLESIGNINWITHUSERNAME': 'false',
@@ -446,11 +447,17 @@ class MattermostK8sCharm(CharmBase):
                 'MM_SAMLSETTINGS_FIRSTNAMEATTRIBUTE': 'fullname',
                 'MM_SAMLSETTINGS_LASTNAMEATTRIBUTE': '',
                 'MM_SAMLSETTINGS_IDPCERTIFICATEFILE': SAML_IDP_CRT,
-                # Otherwise we have to install xmlsec1 and Mattermost forks on every login(!).
-                'MM_EXPERIMENTALSETTINGS_USENEWSAMLLIBRARY': 'true',
             }
         )
 
+        if config['use_experimental_saml_library']:
+            env_config.update(
+                {
+                    # Otherwise we have to install xmlsec1 and Mattermost forks on every login(!).
+                    'MM_EXPERIMENTALSETTINGS_USENEWSAMLLIBRARY': 'true',
+                }
+            )
+
     def _update_pod_spec_for_performance_monitoring(self, pod_spec):
         """Update pod_spec with settings for the Prometheus exporter."""
         config = self.model.config