feat: v2 auth passport cross tenant (IDP merge) - #581
Draft
nikola-maric-aula wants to merge 146 commits into
Draft
feat: v2 auth passport cross tenant (IDP merge)#581nikola-maric-aula wants to merge 146 commits into
nikola-maric-aula wants to merge 146 commits into
Conversation
The logout fix needs two one-time settings: the IdP's end_session_endpoint as the Keycloak identity provider's Logout URL, and Keycloak's static broker logout_response endpoint whitelisted at Eduplaces.
Setting the Logout URL is what starts the calls to the IdP, so the allowlist entry has to exist first or logout breaks in between. Also records how to read the exact redirect uri Keycloak sends rather than trusting the path.
The aula-backend client had front channel logout on with no url, which makes Keycloak return from browserLogout before it reaches the identity provider, so the IdP logout never ran however correct its config was.
Measured: end_session leaves the session live, and prompt=login reaches their authorize endpoint and is ignored. Records that forwarding prompt needs no configuration, so nobody adds it looking for a fix.
Drops the host inventory, the known-issues list and the change history: the file is for configuring Keycloak on a server with the right flow, not for recording how the current one got that way. Also removes the em dashes.
Resolves against #551 (users v2 api) and #568 (phpdoc and types): - adopts main's LaravelSocialiteUser / SocialiteOAuth2User import aliases and the renamed $laravelSocialiteUser parameter, keeping our additions in those methods - LegacyUser status constants became the UserStatus enum - issueSsoSession keeps our version without sso_idp_id_token, which fix/463 drops - test mocks now use the SocialiteProviders subclass, which #551 made the required type while the tests still mocked the Laravel parent. That was breaking 16 of main's own SSO tests, which now pass again - drops a redundant admin seed that #551's new unique index on hash_id turned into a collision 364 passing. The 3 remaining failures are identical on main: two in SsoControllerTest and one in LegacyJwtServiceTest.
model.php reads the claim unconditionally, so every SSO session broke each legacy call. Dropped in 6267a4b.
idp_user_id is also stamped on the seeded admin and on merged accounts, so the reset deleted the admin it exists to hand back.
A school mid-migration has no import to wait for, but its users were held on the setup screen, its admin included.
The claim only fired once an import had made a row, so logins before the merge is applied silently duplicated existing accounts.
Types only, no behaviour: casts where a float or an int reached a string argument, a narrowed find(), and docblocks that named the wrong type.
…tory-sync-and-migration
A login started in the APK left for the browser and never came back. The authorize URL is off-origin, so the Capacitor WebView handed it to Chrome, and the callback then redirected to app.frontend_url, which is a website. Nothing in that chain leads back to an installed app. The initiate endpoints now take ?client=app and record it in the signed state, the only thing that survives the round trip through Keycloak. The callback reads it back and sends every exit, success and error alike, to the app's deep-link scheme instead of the website. Keycloak needs no change: the redirect_uri it sees is still our callback. Only the last hop differs. The scheme comes from config, never from the request, so the callback cannot be pointed anywhere a caller chooses. ## Context <!-- ie. explanations, background, documentation --> <!-- Example: After the last update it became apparent that we did fetch the new results, but didn't actually store them properly. This caused a glitch in the UI whenever the user would refresh the page. --> ## Checklist - [ ] Tested manually <!-- you can strikethrough this option in case you haven't tested manually --> - [ ] GitHub issue linked <!-- Use the "Development" field of the Issue, or add a link if it's outside this Repo --> - [ ] Changelist updated - [ ] Backward and forward compatible with [aula-frontend/releases](https://github.com/aula-app/aula-frontend/releases) <!-- If not, please describe in detail and include other PR links --> - [ ] Independent of the other BE version (v1 <-> v2) <!-- If it isn't, please describe how to deploy them together without downtime --> - [ ] Must be deployed ASAP (HOTFIX) - [ ] Needs update of [docs.aula.de](https://docs.aula.de/) ([repo](https://github.com/leonard-haas/docs_aula)) <!-- If it does, please ping Leonard OR include link to the change in the docs repo -->
## Context <!-- ie. explanations, background, documentation --> Adds endpoint to check if a school allow sso login. Short circuit the sso/initiate when a school does not support sso. Do not allow an user from another school to create an sso account in a different school. ## Checklist - [ ] Tested manually <!-- you can strikethrough this option in case you haven't tested manually --> - [ ] GitHub issue linked <!-- Use the "Development" field of the Issue, or add a link if it's outside this Repo --> - [ ] Changelist updated - [ ] Backward and forward compatible with [aula-frontend/releases](https://github.com/aula-app/aula-frontend/releases) <!-- If not, please describe in detail and include other PR links --> - [ ] Independent of the other BE version (v1 <-> v2) <!-- If it isn't, please describe how to deploy them together without downtime --> - [ ] Must be deployed ASAP (HOTFIX) - [ ] Needs update of [docs.aula.de](https://docs.aula.de/) ([repo](https://github.com/leonard-haas/docs_aula)) <!-- If it does, please ping Leonard OR include link to the change in the docs repo -->
…h-passport-cross-tenant
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Context
This is how far I got in merging our branches.
And here is my branch without attempting to merge the current IDP branch: #567
Checklist