Allow redirecting from login form directly to the /saml/login route

Created on 1 September 2023, about 2 years ago
Updated 9 February 2024, over 1 year ago

Problem/Motivation

When using a single SSO provider and enforcing that everyone has to login via SSO, rather than them seeing the login form and clicking the link, I would rather the user get redirected directly to the SSO right away.

Proposed resolution

Add a new boolean config for force login form to redirect to SSO login.

✨ Feature request
Status

Fixed

Version

3.0

Component

Code

Created by

πŸ‡ΊπŸ‡ΈUnited States dave reid Nebraska USA

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Merge Requests

Comments & Activities

  • Issue created by @dave reid
  • Open in Jenkins β†’ Open on Drupal.org β†’
    Core: 9.5.5 + Environment: PHP 7.4 & MySQL 5.7
    last update about 2 years ago
    4 pass
  • Open in Jenkins β†’ Open on Drupal.org β†’
    Core: 9.5.5 + Environment: PHP 7.4 & MySQL 5.7
    last update about 2 years ago
    4 pass
  • Open in Jenkins β†’ Open on Drupal.org β†’
    Core: 9.5.5 + Environment: PHP 7.4 & MySQL 5.7
    last update about 2 years ago
    2 fail
  • Open in Jenkins β†’ Open on Drupal.org β†’
    Core: 9.5.5 + Environment: PHP 7.4 & MySQL 5.7
    last update about 2 years ago
    2 fail
  • Status changed to Needs work about 2 years ago
  • πŸ‡ΊπŸ‡ΈUnited States dave reid Nebraska USA
  • Open in Jenkins β†’ Open on Drupal.org β†’
    Core: 9.5.5 + Environment: PHP 7.4 & MySQL 5.7
    last update about 2 years ago
    2 fail
  • πŸ‡³πŸ‡±Netherlands roderik Amsterdam,NL / Budapest,HU

    Uhm... I've kept going back and forth on several considerations while thinking about this patch. To keep the story somewhat short, my current state of mind is:

    • This is a viable addition to the module. (I felt some resistance because 1) many people won't want this because they have some privileged users needing to log in locally; 2) the "it can be achieved by other modules" comment in the README. But really the redirect from this one login screen, belongs in this module.)
    • I should not have added the 'login_link_show' boolean config option on top of the string/label; instead, changed it to just the label and just not showing it when empty. I can still drop it while maintaining backward compatibility, and will likely do so.

    FWIW your option to have a default value for the label is generally viable, but I don't want to make that change (thereby making the link show up for everyone who upgrades) in a minor version update.

    When I drop this checkbox, there can likely be a new boolean option, where TRUE (not FALSE) means redirect, and the #states stuff can influence the 'drupal_login_roles' setting.
    (I don't know if a new boolean option is better or worse than having a special value in 'drupal_login_roles' that means "never show the login screen at all". Probably better.)

    Will think about it again after finishing some other changes.

  • Open in Jenkins β†’ Open on Drupal.org β†’
    Core: 9.5.5 + Environment: PHP 7.4 & MySQL 5.7
    last update almost 2 years ago
    2 fail
  • Status changed to Needs review almost 2 years ago
  • πŸ‡³πŸ‡±Netherlands roderik Amsterdam,NL / Budapest,HU

    As said earlier:

    • removed (bool) 'login_link_show' setting
    • added (bool) 'login_auto_redirect' setting, whose use is inverted, and not dependent on / entangled with the 'login_link_title' setting. (This also means the login link is still visible on login blocks.)

    I'm likely to check if I can exchange RedirectUserLoginFormSubscriber for a subscriber that sits on RoutingEvents::ALTER instead, and just execute the login code + redirect from /user/login directly to the IdP without going through /saml/login in between.

    I don't know where the current test failure comes from. It's possible that it's a failure in the 8.x-3.x branch. I have to fix my somehow-broken ability to run PHPUnit locally.

  • Open in Jenkins β†’ Open on Drupal.org β†’
    Core: 9.5.5 + Environment: PHP 7.4 & MySQL 5.7
    last update almost 2 years ago
    4 pass
  • Status changed to Fixed almost 2 years ago
  • πŸ‡³πŸ‡±Netherlands roderik Amsterdam,NL / Budapest,HU

    Merged. I did mess up the tests a few days ago - now fixed.

    My remark about "exchange RedirectUserLoginFormSubscriber for a subscriber that sits on RoutingEvents::ALTER instead" is senseless; the better solution is to have RedirectUserLoginFormSubscriber immediately do the saml/login stuff and redirect to the IDP.

    I first need to fix πŸ“Œ Reimplement response caching on login/logout routes Active for that, though.

  • Issue was unassigned.
  • πŸ‡³πŸ‡±Netherlands roderik Amsterdam,NL / Budapest,HU
  • Automatically closed - issue fixed for 2 weeks with no activity.

  • πŸ‡§πŸ‡¬Bulgaria yivanov

    I was just looking for that feature. When is it planned to be released?

Production build 0.71.5 2024