This issue is related to one of the comments in simplesamlphp_auth.module:

ISSUE: User is always dropped on user page after login, instead of where they were when they clicked "Federated Log In". Because of this, deep linking to access controlled content does not work. Usability would be considerably increased if this were resolved.

Just to illustrate what I'd like to fix, here are a couple scenarios.

Without this module (just the usual Drupal auth in place), it goes like this:

  1. User visits a protected page ( /admin )
  2. Drupal returns the "Access Denied" page, including a link to log in - that link goes to /user/login?destination=admin
  3. User visits that page, and logs in
  4. and finally gets redirected back to /admin, which they can now view as an authenticated user

With SimpleSAMLphp Auth active (at least with 7.x-3.x-dev), the process varies starting with step 3:

  1. User visits a protected page ( /admin )
  2. Drupal returns the "Access Denied" page, including a link to log in - that link goes to /user/login?destination=admin
  3. User visits /user/login?destination=admin -- there they still see the usual username and password field, but also a link to login via SAML, which by default is a link to /saml_login labeled "Federated Log In"
  4. User visits /saml_login, is taken off to the SAML IdP's login process
  5. and eventually comes back to the Drupal site, and is dropped at /user

There are some existing issues relating to this, but I'm not sure the proposed fixes quite address what I'm trying to accomplish. It looks like there's support for a ReturnTo parameter in 7.x-3.x, but I wasn't sure how to use that.

My proposed fix (inspired by brad.bulger's comment on this other issue) is to modify the /saml_login link that is displayed on the /user/login page to also include the destination query parameter. Continuing with the example of trying to visit /admin:

  1. user visits /admin, gets "access denied"
  2. clicks the Log in link, taking them to /user/login?destination=admin
  3. with this change, that page would link to /saml_login?destination=admin (instead of just /saml_login)
  4. user clicks that Federated Log In link
  5. user gets redirected to the SAML IdP, and logs in
  6. and gets redirected back to /saml_login?destination=admin
  7. since they've now authenticated, user is finally redirected to /admin
CommentFileSizeAuthor
#4 preserve-login-destination-2684535-4-7.x-3.x-dev.patch713 byteslarcher
#2 preserve-login-destination-2684535-2-7.x-3.x-dev.patch829 byteslarcher

Comments

larcher created an issue. See original summary.

larcher’s picture

larcher commented
StatusFileSize
new preserve-login-destination-2684535-2-7.x-3.x-dev.patch829 bytes
snufkin’s picture

snufkin commented
Status: Active » Needs work

Looks good, thanks for this. Just a couple of standard related comments:

  1. +++ b/simplesamlphp_auth.module
@@ -278,7 +278,12 @@ function simplesamlphp_auth_form_alter(&$form, $form_state, $form_id) {
+  if (isset($_GET['destination'])) { ¶

    Could you fix the whitespace issue here? 

  2. +++ b/simplesamlphp_auth.module
@@ -278,7 +278,12 @@ function simplesamlphp_auth_form_alter(&$form, $form_state, $form_id) {
+  } else {

    Could you please put the else on a new line according to Drupal coding standards?

larcher’s picture

larcher commented
StatusFileSize
new preserve-login-destination-2684535-4-7.x-3.x-dev.patch713 bytes

Thanks for the quick review. I actually just learned about drupal_get_destination, which would eliminate any direct checking of $_GET['destination']. New patch attached.

larcher’s picture

larcher commented
Status: Needs work » Needs review
larcher’s picture

larcher commented
Related issues: +#1912132: Add option to specify a destination URL for users after logging in, +#1820870: Returning user to current page, +#1568172: Configurable dynamic destination login/logout menu links
snufkin’s picture

snufkin commented
Status: Needs review » Fixed

Thanks, committed.

  • snufkin committed 6e92be6 on 7.x-3.x authored by larcher 
    Issue #2684535 by larcher: Redirect to original destination after...

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.

nileshnpathade@gmail.com’s picture

nileshnpathade@gmail.com commented

I am facing issue realated saml_login.

I am missing something, I am very new in Drupal. I have drupal site which is using saml login.

When I called www.mydomainname.com/user/login then it's automatically called www.mydomainname/saml_login and showing white page..

even I can't login with admin as well.
Please assist me.

Regard
Nil