Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

SSO redirect issue with iOS native client #2028

Closed
moritzmann1 opened this issue Jan 25, 2016 · 16 comments · Fixed by #3407
Closed

SSO redirect issue with iOS native client #2028

moritzmann1 opened this issue Jan 25, 2016 · 16 comments · Fixed by #3407
Assignees
@rodrigok
Labels
feat: oauth / sso type: support
Milestone
0.32.0

Comments

@moritzmann1
Copy link

Rocket.chat runs fine with SAML HTTP POST Binding for all clients except Android (known issue? RocketChat/Rocket.Chat.Cordova#59) and iOS clients.

iOS iPhone clients show a white "load error" page after the SSO Login. The SAML communication on the Rocket.chat server below shows the SAML handshake works:

POST /_saml/validate/SAMLIdp HTTP/1.1
Connection: upgrade
Host: chat.open.ch
X-Real-IP: 192.168.35.202
X-Forward-For: 192.168.35.202
X-Forward-Proto: http
X-Nginx-Proxy: true
Content-Length: 6258
Content-Type: application/x-www-form-urlencoded
Origin: https://sso.somedomain.com
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 9_2_1 like Mac OS X) AppleWebKit/601.1.46 (KHTML, like Gecko) Mobile/13D15
Referer: https://sso.somedomain.com/sso-login/SSOPOST/metaAlias/SAMLIdp?SAMLRequest=nVNdb5swFH3fr0B%2BDw7Rsq1WiESDqkXKVhTYJu1l8sxtsWRs6ntp038%2FQ5MoUr
<.. undisclosed ..>
ldpkde0BMURvjHtZeQgppox8D8E9fy%2FtqHe%2Fc1CPGxj6IthdtYEr13bSaxyKgp1UdIj9lHhlQqpbeLimhIswJdRAHcZFeLw4Xw9LDCoYq7y02DlP%2B8LO6TlmdDaOEBZ%2F%2F5su%2FwE%3D&RelayState=SAMLIdp
Accept-Language: en-us
Accept-Encoding: gzip, deflate

SAMLResponse=PHNhbWxwOlJlc3BvbnNlIHhtbG5zOnNhbWxwPSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6%0D%0AcHJvdG9jb2wiIElEPSJzMmJiOGQ5NTZmMDMxMTVkOWVlZTgxYTIxNTU2MTNjMGMyZjZmNmRjNzEi%0D%0AIEluUmVzcG9uc2VUbz0iVERGTFBlV0Q0eURCcWhvc2kiIFZlcnNpb249IjIuMCIgSXNzdWVJbnN0%0D%0AYW50PSIyMDE2LTAxLTI1VDE3OjI5OjI2WiIgRGVzdGluYXRpb249Imh0dHBzOi8vY2hhdC5vcGVu%0D%0ALmNoL19zYW1sL3ZhbGlkYXRlL1NBTUxJZHAiPjxzYW1sOklzc3VlciB4bWxuczpzYW1sPSJ1cm46%0D%0Ab2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6YXNzZXJ0aW9uIj5TQU1MSWRwPC9zYW1sOklzc3Vlcj48%0D%0Ac2FtbHA6U3RhdHVzIHhtbG5zOnNhbWxwPSJ1cm
<.. undisclosed ..>
bWEiIHhtbG5zOnhzaT0iaHR0cDovL3d3dy53My5vcmcvMjAwMS9YTUxTY2hlbWEtaW5z%0D%0AdGFuY2UiIHhzaTp0eXBlPSJ4czpzdHJpbmciPjE5Mi4xNjguMzUuMjAyPC9zYW1sOkF0dHJpYnV0%0D%0AZVZhbHVlPjwvc2FtbDpBdHRyaWJ1dGU%2BPC9zYW1sOkF0dHJpYnV0ZVN0YXRlbWVudD48L3NhbWw6%0D%0AQXNzZXJ0aW9uPjwvc2FtbHA6UmVzcG9uc2U%2B%0D%0A&RelayState=SAMLIdp

HTTP/1.1 200 OK
Vary: Accept-Encoding
Access-Control-Allow-Origin: *
X-Rocket-Chat-Version: 0.0.1
Access-Control-Expose-Headers: X-Rocket-Chat-Version
X-Powered-By: Express
Content-Type: text/html
Date: Mon, 25 Jan 2016 17:29:26 GMT
Connection: keep-alive
Transfer-Encoding: chunked

57
<html><head><script>window.close()</script></head><body><H1>Verified</H1></body></html>
@moritzmann1
Copy link
Author

Please let me know, should you need additional information! Does this work for anybody?

@bretwilcox
Copy link

We are seeing an issue but instead of seeing "load error" we just see a white "Verified" page after successfully authenticating.

@cperrin88
Copy link

👍 I see the same behaviour. I'd like to disable form based logins completely but this is not possible now.

@moritzmann1
Copy link
Author

As a workaround: should LDAP form-based login in parallel to SSO?

I ask because LDAP authentication only seems to work for first-time users and not existing ones.

@bretwilcox
Copy link

Is there any more information needed to get this addressed? This is a big issue for us. To stay SOX compliant we have to turn off other forms of authentication.

@jeffreywescott
Copy link
Contributor

Also seeing the "Verified" page after a SAML login (on iOS client). Any workarounds?

@jeffreywescott
Copy link
Contributor

FYI, this seems to have to do with two things:

  1. meteor-accounts-saml uses window.close() to complete the sign-in process.
  2. Cordova InAppBrowser doesn't support window.close().

Seems likely that this issue should be filed on meteor-accounts-saml instead of here.

A possible workaround would be something like this.

@jeffreywescott jeffreywescott mentioned this issue Jan 31, 2016
Closed
@engelgabriel engelgabriel added this to the 0.22.0 milestone Mar 4, 2016
@engelgabriel
Copy link
Member

@rodrigok do we need more info to replicate the problem?

@engelgabriel engelgabriel modified the milestones: 0.22.0, 0.23.0, 0.24.0 Mar 16, 2016
@rodrigok
Copy link
Member

Someone can help me to setup SAML at my local server to test this behavior?

@engelgabriel engelgabriel modified the milestones: 0.24.0, 0.25.0 Mar 28, 2016
@engelgabriel engelgabriel modified the milestones: 0.25.0, 0.26.0, 0.27.0 Apr 5, 2016
@engelgabriel engelgabriel modified the milestones: 0.30.0, 0.31.0, 0.32.0 May 12, 2016
@rore
Copy link

rore commented May 30, 2016

Any idea how we go forward with this?

@dekelev
Copy link

dekelev commented May 30, 2016

@engelgabriel Can you use this forked repo instead?
https://github.com/gigya/meteor-accounts-saml

engelgabriel added a commit that referenced this issue May 30, 2016
@engelgabriel
Fix #2028 SSO redirect issue with iOS native client
99d405f
@engelgabriel engelgabriel mentioned this issue May 30, 2016
Merged
engelgabriel added a commit that referenced this issue May 30, 2016
@engelgabriel
Merge pull request #3407 from RocketChat/cordova-saml
0cebe25 
Fix #2028 SSO redirect issue with iOS native client
This was referenced Sep 3, 2020
Open
Open
Open
@snyk-bot snyk-bot mentioned this issue Jul 13, 2021
Open
This was referenced Jan 11, 2022
Open
Open
Open
Open
Open
Open
This was referenced Mar 20, 2022
Open
Open
Open
Open
Open
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@rodrigok rodrigok

Labels
feat: oauth / sso type: support
Projects
None yet
Milestone
0.32.0
Development

Successfully merging a pull request may close this issue.

Fix #2028 SSO redirect issue with iOS native client RocketChat/Rocket.Chat
10 participants
@Sing-Li @jeffreywescott @cperrin88 @bretwilcox @rodrigok @rore @engelgabriel @marceloschmidt @dekelev @moritzmann1