feat(auth): two-step login with SSO (SAML2 and OIDC) - #211
Draft
edospadoni wants to merge 3 commits into
Draft
Conversation
edospadoni
changed the title
Split the login form in two steps: the host is entered first, then its config/config.production.js is read to detect the authentication method. With saml2 the credentials step shows a single SSO button: the main process runs the SAML dance in a dedicated browser window (persistent session, so later logins are silent) and mints the JWT on the forwardAuth-guarded /api/sso-login endpoint. SSO accounts are stored without a password and, when the token expires, go through the interactive SSO flow again.
Add an AuthenticationMethod type and an isSsoMethod() helper so saml2 and oidc share the same SSO flow (host-config detection, dedicated login window, token mint on the ?ssologin return leg). The concrete method is stored on the account for accurate auto-login handling.
Map a 401/403 mint failure to a dedicated 'user not enabled for CTI' message instead of the generic SSO failure. Also add the missing SSO i18n keys to the renderer locales used in dev builds.
edospadoni
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Split the login form in two steps and add Single Sign-On support (SAML2 and
OpenID Connect / OAuth2), matching the SSO flow introduced in NethVoice CTI:
config/config.production.jsisread to detect
AUTHENTICATION_METHOD(hosts without the key default topassword, fully backward compatible).passwordhosts, or a singleSSO button (
SSO_BUTTON_LABEL/SSO_LOGIN_URL) for SSO hosts (saml2oroidc).With SSO, the main process runs the SSO flow in a dedicated browser window
(persistent session partition, so later logins are silent while the IdP
session lasts) and mints the JWT on the forwardAuth-guarded
/api/sso-loginendpoint; the CTI SPA is never loaded. SSO accounts are stored without a
password: while the JWT is valid the auto-login works as usual, once expired
the interactive SSO flow is required again. Saved password accounts keep the
current behavior.
A user that authenticates on the IdP but is not a CTI user gets a clear
"not enabled for CTI" message (a 401/403 mint result) instead of a generic
SSO failure.
saml2andoidcshare the same flow via anisSsoMethod()helper; only thefront-door differs on the server side.
Related issue
NethServer/dev#8142
How to test
npm run devauthentication_method: saml2oroidc), press Continue: only the SSO button is shown; complete the login on the IdP window and verify NethLink logs in.passwordhost: username/password are asked as before.Dependencies
Server-side SSO support: nethesis/ns8-nethvoice#958, nethesis/nethcti-server#357, nethesis/nethcti-middleware#79, nethesis/nethvoice-cti#558