Problem/Motivation

When using a single SSO provider and enforcing that everyone has to login via SSO, rather than them seeing the login form and clicking the link, I would rather the user get redirected directly to the SSO right away.

Proposed resolution

Add a new boolean config for force login form to redirect to SSO login.

Issue fork samlauth-3384859

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

Comments

Dave Reid created an issue. See original summary.

dave reid’s picture

Status: Active » Needs work
roderik’s picture

Uhm... I've kept going back and forth on several considerations while thinking about this patch. To keep the story somewhat short, my current state of mind is:

  • This is a viable addition to the module. (I felt some resistance because 1) many people won't want this because they have some privileged users needing to log in locally; 2) the "it can be achieved by other modules" comment in the README. But really the redirect from this one login screen, belongs in this module.)
  • I should not have added the 'login_link_show' boolean config option on top of the string/label; instead, changed it to just the label and just not showing it when empty. I can still drop it while maintaining backward compatibility, and will likely do so.

FWIW your option to have a default value for the label is generally viable, but I don't want to make that change (thereby making the link show up for everyone who upgrades) in a minor version update.

When I drop this checkbox, there can likely be a new boolean option, where TRUE (not FALSE) means redirect, and the #states stuff can influence the 'drupal_login_roles' setting.
(I don't know if a new boolean option is better or worse than having a special value in 'drupal_login_roles' that means "never show the login screen at all". Probably better.)

Will think about it again after finishing some other changes.

roderik’s picture

Status: Needs work » Needs review

As said earlier:

  • removed (bool) 'login_link_show' setting
  • added (bool) 'login_auto_redirect' setting, whose use is inverted, and not dependent on / entangled with the 'login_link_title' setting. (This also means the login link is still visible on login blocks.)

I'm likely to check if I can exchange RedirectUserLoginFormSubscriber for a subscriber that sits on RoutingEvents::ALTER instead, and just execute the login code + redirect from /user/login directly to the IdP without going through /saml/login in between.

I don't know where the current test failure comes from. It's possible that it's a failure in the 8.x-3.x branch. I have to fix my somehow-broken ability to run PHPUnit locally.

  • roderik committed 16b1c03e on 8.x-3.x authored by Dave Reid
    Issue #3384859 by Dave Reid, roderik: Allow redirecting from login form...
roderik’s picture

Status: Needs review » Fixed
Related issues: +#3211536: Reimplement response caching on login/logout routes

Merged. I did mess up the tests a few days ago - now fixed.

My remark about "exchange RedirectUserLoginFormSubscriber for a subscriber that sits on RoutingEvents::ALTER instead" is senseless; the better solution is to have RedirectUserLoginFormSubscriber immediately do the saml/login stuff and redirect to the IDP.

I first need to fix #3211536: Reimplement response caching on login/logout routes for that, though.

roderik’s picture

Assigned: dave reid » Unassigned

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.

yivanov’s picture

I was just looking for that feature. When is it planned to be released?