Pass "next" URL through SAML RelayState #851
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Codecov ReportAttention:
Additional details and impacted files@@ Coverage Diff @@
## master #851 +/- ##
==========================================
+ Coverage 77.20% 77.27% +0.06%
==========================================
Files 339 339
Lines 10340 10380 +40
Branches 696 699 +3
==========================================
+ Hits 7983 8021 +38
- Misses 2200 2201 +1
- Partials 157 158 +1
Flags with carried forward coverage won't be shown. Click here to find out more.
☔ View full report in Codecov by Sentry. |
RJPercival
force-pushed
the
next_url_in_relay_state
branch
3 times, most recently
from
212a1ea
to
9e9df11
Compare
digismack
approved these changes
Nov 9, 2023
|
Looks good to me. Thanks! |
Almost all other arguments to `do_complete` were being passed to the backend, except for this. Without it, the backend cannot reliably access the redirect URL in the session state (which is useful if the backend wants to set the redirect URL, e.g. based on SAML RelayState).
This is the primary use case for RelayState, but the SAML backend did not previously support this use. Instead, it relied on the Strategy to store the "next" URL in session state and restore it from there after login. Unfortunately, in the case of SAML, this does not work if the server has set the session cookie's `SameSite` attribute to "Lax" or "Strict", as the SAML POST request from the IdP will not contain the session cookie. The new `RelayState` format (a JSON object) allows for further extensibility, as arbitrary additional fields can be added in the future.
RJPercival
force-pushed
the
next_url_in_relay_state
branch
from
9e9df11
to
b631796
Compare
|
Looks like I'm not authorized to merge this @digismack. |
|
@digismack, thanks for merging. Any idea when this will go out in a release? |
|
We need a new release soon to address #854, but it needs to be fixed first… |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Passing the "next" URL to redirect to after authentication completes is the primary use case for
RelayState, but the SAML backend did not previously support this use. Instead, it relied on theStrategyto store the "next" URL in session state and restore it from there after login. Unfortunately, in the case of SAML, this does not work if the server has set the session cookie'sSameSiteattribute to "Lax" or "Strict", as the SAML POST request from the IdP will not contain the session cookie.The new
RelayStateformat (a JSON object) allows for further extensibility, as arbitrary additional fields can be added in the future.A number of additional SAML response test fixtures have been added - these differ only in the value of the
RelayStateparameter, and are used for testing different values (e.g. missing keys in the JSON).I've manually tested this with Okta and Django and the redirect works as intended (it previously did not).