feat(auth): two-step login with SSO (SAML2 and OIDC) - #211
Draft
edospadoni wants to merge 1 commit into
Draft
edospadoni wants to merge 1 commit into
edospadoni wants to merge 1 commit into
Conversation
edospadoni
changed the title
edospadoni
changed the title
Rebased onto main after the eslint 9 migration (#220). The three original commits are squashed into one: they were authored against the unformatted tree, so replaying them individually onto the reformatted main conflicted in six files with nothing but whitespace. Formatting both sides with the same config first and transferring the resulting diff keeps the change set identical to what was reviewed (+515/-116 against main, vs +458/-106 before) without hand-resolving formatting noise. Squashed from: 37dfa9c feat(auth): two-step login with Single Sign-On support 7a3f336 feat(auth): extend SSO support to OIDC bf1b88b feat(auth): show a clear error when an SSO user is not enabled on CTI Conflict resolved during the rebase: the IPC_EVENTS enum in src/shared/constants.ts gained GET_HOST_CONFIG, SET_HOST_CONFIG, SSO_LOGIN, SSO_LOGIN_RESULT and RECONNECT_PHONE_ISLAND. None of the five exist on main, so all were kept. Still a draft: not ready to merge.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Split the login form in two steps and add Single Sign-On support (SAML2 and
OpenID Connect / OAuth2), matching the SSO flow introduced in NethVoice CTI:
config/config.production.jsisread to detect
AUTHENTICATION_METHOD(hosts without the key default topassword, fully backward compatible).passwordhosts, or a singleSSO button (
SSO_BUTTON_LABEL/SSO_LOGIN_URL) for SSO hosts (saml2oroidc).With SSO, the main process runs the SSO flow in a dedicated browser window
(persistent session partition, so later logins are silent while the IdP
session lasts) and mints the JWT on the forwardAuth-guarded
/api/sso-loginendpoint; the CTI SPA is never loaded. SSO accounts are stored without a
password: while the JWT is valid the auto-login works as usual, once expired
the interactive SSO flow is required again. Saved password accounts keep the
current behavior.
A user that authenticates on the IdP but is not a CTI user gets a clear
"not enabled for CTI" message (a 401/403 mint result) instead of a generic
SSO failure.
saml2andoidcshare the same flow via anisSsoMethod()helper; only thefront-door differs on the server side.
Related issue
NethServer/dev#8142
How to test
npm run devauthentication_method: saml2oroidc), press Continue: only the SSO button is shown; complete the login on the IdP window and verify NethLink logs in.passwordhost: username/password are asked as before.Dependencies
Server-side SSO support: nethesis/ns8-nethvoice#958, nethesis/nethcti-server#357, nethesis/nethcti-middleware#79, nethesis/nethvoice-cti#558