Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

If SSO Authentication is enabled, many authenticated features still requires a password. #619

Open
danifran opened this issue Aug 31, 2021 · 3 comments · May be fixed by #620
Open

If SSO Authentication is enabled, many authenticated features still requires a password. #619

danifran opened this issue Aug 31, 2021 · 3 comments · May be fixed by #620

Comments

@danifran
Copy link

If SSO is enabled, many authenticated modules still asks for the user's password. In particular the change password module and the update profile module requires a password because they the user's credential to connect to the LDAP system. This happens even if a proxy user has been configured for the target system.

Steps to reproduce:

  1. Configure an SSO authentication method (for example, http header)
  2. Enable the Change password and update profile modules
  3. Log on the system with the external SSO (or make all request using the correct header), then click on the Change Password module or update profile module

The system will redirect the user to the login page asking for a password, but the user has already been authenticated (maybe even with stronger factors) by the external identity provider.
@danifran danifran linked a pull request Aug 31, 2021 that will close this issue
Open
@jrivard
Copy link
Contributor

jrivard commented Sep 1, 2021

This is normal behavior depending on the directory and configuration. I'm assuming you mean AD which is one of the few LDAP directories that allow changing the password via a proxy user (aka 3rd party change) without consequences. Can you confirm this is for AD or are you having this issue with another LDAP directory.

@danifran
Copy link
Author

danifran commented Sep 1, 2021

The behavior changed after version 1.7. With version 1.7, we were able to let the user change his password without requiring him to provide a password.
I confirm the target environment is AD and we have already configured a proxy account. We are verifying the new PWM version before upgrading our current 1.7 version.

@danifran
Copy link
Author

We managed to create a chai provider if the proxy account is defined (we just used existing code, wired up on the authentication section) as per the attached pull request

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Enabled chai provider with proxy user if SSO enabled danifran/pwm
2 participants
@jrivard @danifran