Problem/Motivation
When using a single SSO provider and enforcing that everyone has to login via SSO, rather than them seeing the login form and clicking the link, I would rather the user get redirected directly to the SSO right away.
Proposed resolution
Add a new boolean config for force login form to redirect to SSO login.
Issue fork samlauth-3384859
Show commands
Start within a Git clone of the project using the version control instructions.
Or, if you do not have SSH keys set up on git.drupalcode.org:
Comments
Comment #3
dave reidComment #4
roderikUhm... I've kept going back and forth on several considerations while thinking about this patch. To keep the story somewhat short, my current state of mind is:
FWIW your option to have a default value for the label is generally viable, but I don't want to make that change (thereby making the link show up for everyone who upgrades) in a minor version update.
When I drop this checkbox, there can likely be a new boolean option, where TRUE (not FALSE) means redirect, and the #states stuff can influence the 'drupal_login_roles' setting.
(I don't know if a new boolean option is better or worse than having a special value in 'drupal_login_roles' that means "never show the login screen at all". Probably better.)
Will think about it again after finishing some other changes.
Comment #5
roderikAs said earlier:
I'm likely to check if I can exchange RedirectUserLoginFormSubscriber for a subscriber that sits on RoutingEvents::ALTER instead, and just execute the login code + redirect from /user/login directly to the IdP without going through /saml/login in between.
I don't know where the current test failure comes from. It's possible that it's a failure in the 8.x-3.x branch. I have to fix my somehow-broken ability to run PHPUnit locally.
Comment #7
roderikMerged. I did mess up the tests a few days ago - now fixed.
My remark about "exchange RedirectUserLoginFormSubscriber for a subscriber that sits on RoutingEvents::ALTER instead" is senseless; the better solution is to have RedirectUserLoginFormSubscriber immediately do the saml/login stuff and redirect to the IDP.
I first need to fix #3211536: Reimplement response caching on login/logout routes for that, though.
Comment #8
roderikComment #10
yivanov commentedI was just looking for that feature. When is it planned to be released?