Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fallback URL query for "SSO.FORCE_USER_TO_LOGINPAGE" #1542

Open
kbilev opened this issue Aug 3, 2023 · 4 comments
Open

Fallback URL query for "SSO.FORCE_USER_TO_LOGINPAGE" #1542

kbilev opened this issue Aug 3, 2023 · 4 comments

Comments

@kbilev
Copy link
Contributor

kbilev commented Aug 3, 2023

Is your feature request related to a problem? Please describe.
No direct problem, but what happens if "SSO.FORCE_USER_TO_LOGINPAGE" is enabled and for a reason the SSO Service is not available?
If "SSO.FORCE_USER_TO_LOGINPAGE" is enabled, the login form is disabled, so no possibility to login via the local user

Describe the solution you'd like
Maybe it would be a good idea to add a system setting like "SSO.FALLBACK_QUERY" and add a check in the UsersController to disable the redirection if the query is included in the login URL (/login?disable_redirect=true")

Describe alternatives you've considered
Disable Javascript in the browser to disable the redirect, but also the login form uses javascript. This seems a bad workaround

Best Regards,
Kevin

@nook24
Copy link
Member

nook24 commented Aug 14, 2023

Hi @kbilev
another workaround would be to disable the redirect with a SQL query like so:

UPDATE systemsettings SET `value` = 0 WHERE `key` = "FRONTEND.SSO.FORCE_USER_TO_LOGINPAGE";

Hope this helps

@kbilev
Copy link
Contributor Author

kbilev commented Aug 16, 2023

Hello @nook24,
yes this would be a possible workaround for my mentioned case where the SSO Service is not available.
If I want to use some local users for testing/debugging and also redirect SSO Users, this workaround would not work.
The easiest workaround for our use case was to comment out the "if ($forceRedirectSsousersToLoginScreen === false):" in the Users/login.php template to have the login form still available on the login page and cancel the javascript redirect in the browser (Escape)
Best Regards,
Kevin

nook24 added a commit that referenced this issue Aug 16, 2023
This code is an attempt, to temporarily disable the SSO force redirection for debugging and testing purpose.
The basic idea is, to simply add the parameter disable_redirect=1 to the query string, to disable the redirect.
E.g.: /users/login?disable_redirect=1

The issue with this approach is, that the HTML template gets loaded without any input fields for the login.
The template URL is hardcoded and can not take any parameters (at least to my knowledge)
Therefore this code currently disabled the redirect, but the user has no login fields. Not that helpful :(
@nook24
Copy link
Member

nook24 commented Aug 16, 2023

While I was going to implement the query string parameter, I noticed some issue. The login template itself does not contain any form information, when the SSO redirect is enabled.
The template URL is hardcoded and can not take any parameters (at least to my knowledge).

My attempt is currently disabling the redirect, but the user has no login fields. Not that helpful :(

I have pushed my code into the branch issue-1542 feel free to use this as entry point.

@kbilev
Copy link
Contributor Author

kbilev commented Aug 16, 2023

I have created a pull request to your branch with a working solution based on your work.
As I am no php nor Cake expert, I don't know if this solution is okay

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants