Problem/Motivation

When a browser already has a Drupal session from OIDC SSO with sufficient assurance, File Gate should establish the plain-link bridge without a hand-placed Bearer token in sessionStorage.

GitHub: #41. Program plan: docs/PLAN.md, architecture: docs/KEYCLOAK-UNIFIED-AUTH.md.

Proposed resolution

Same-origin path: logged-in user + valid grant + matching subject + ACR policy → bridge cookie. Fail closed on mismatch. HMAC grant still required.

Remaining tasks

  • Implementation + Kernel deny-path tests
  • Docs
  • Dual-venue close on ship

API changes

Optional internal/session bridge establish path; public download contract unchanged.

Comments

jmcerda created an issue. See original summary.

jmcerda’s picture

jmcerda
Location Boca Raton, FL
commented
Status: Active » Fixed

Fixed on 1.x (GitHub PR #48). Will ship in the next File Gate minor release (1.5.0).

https://github.com/Wilkes-Liberty/file_gate/pull/48

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.

jmcerda’s picture

jmcerda
Location Boca Raton, FL
commented
Status: Fixed » Closed (fixed)
jmcerda’s picture

jmcerda
Location Boca Raton, FL
commented

Closed (fixed): Drupal SSO session bridge for same-origin assurance downloads shipped on 1.x via GitHub PR #48 (GH #41). Next minor 1.5.0.

https://github.com/Wilkes-Liberty/file_gate/pull/48

jmcerda’s picture

jmcerda
Location Boca Raton, FL
commented

Confirm Closed (fixed). Work shipped; removing from Open queue.