Page URL usage is infinitely looping SSO step (using SAML module)

0
Hi,   we recently tried to replace the DeepLink module with the built in page URL/Microflow URL feature after upgrading to 10.18.4. As we're using SAML for SSO auth, i also upgraded to SAML 4.0.1.    But now, after removing all legacy evidence of the old DeepLink module, and modifying page prefix,  index.html/index3.html according to documentation something strange is happening:  when using an actual URL to a page (like: ./link/mypage) the SSO step is ending up in an infinite loop. So only when using a pageURL this infinite loop is caused logging on to standard landing page without PageURL reference is working fine, no SSO loop. All good.   some details:  index.html is "DefaultLoginPage" index3.html is "SSOLandingPage" index.html is containing these recommended 2 lines inside script tags: const returnURL = encodeURIComponent(window.location.search+window.location.hash); self.location = '/SSO/login?cont='+returnURL; (no further lines in that file forward to /SSO/ ). Also, general structure of this file is related to "login-with-mendixsso-automatically.html" as recommended in the SAML docs.  index3.html is not containing any forwarding to /SSO/. I mean, it's actually working well for app access attempts without using pageURLs. SAMLConfig.properties content:  sso.path=SSO/ sso.discovery.allowed=true sso.discovery.redirectToFirstIdP=true sso.principalvalue.tolowercase = true environment is set to SameSiteCookies = Lax (tried with "None", too). Normal SSO auth is working, as already said.  For testing, i removed any role based landing pages, did not help.   When not using a proper PageURL on purpose which is actually not existing, browser gives an "file not found" error, as expected. That loop only happens when using a valid/existing PageURL parameter. So at least, the mdx engine is getting to validate the parameter against available pages that have been setup with a URL in MDX Studio.   It seems like the authenticated session after the actual SSO part is not forwarded back to SAML module that normally would pass it over to index3.html. Result: a new SSO action step seems necessary = loop. But that's assumptions only.  starting to logon to app (including PageURL) by using <appURL>/link/myPage getting forwarded to <appURL>/SSO/ -> successful authentication getting forwarded to URL: <appURL>/SSO/login?cont=link%2FmyPage forward to SSO (again) getting back to URL: <appURL>/SSO/login?cont=link%2FmyPage ... loop.   Any ideas what setting is causing this?   
asked
2 answers
0

Please check below question for same issue.

 

Mendix Community - Question Details

answered
0

My solution for this topic was using the following as index.html content: 

 

<!doctype html>
<html>
    <head>
        {{unsupportedbrowser}}
        <meta charset="utf-8">
        <title>AppName</title>
        <meta name="viewport" content="width=device-width, initial-scale=1">
        {{themecss}}
        {{appicons}}
        {{manifest}}
        {{startupimages}}
    </head>
    <body dir="ltr">
        <noscript>To use this application, please enable JavaScript.</noscript>
        <div id="content"></div>
        <script>
            dojoConfig = {
                isDebug: false,
                useCustomLogger: true,
                async: true,
                baseUrl: "mxclientsystem/dojo/",
                cacheBust: "{{cachebust}}",
                rtlRedirect: "index-rtl.html"
            };
        </script>
        <script> 
            if (!document.cookie || !document.cookie.match(/(^|;) *originURI=/gi)) {
                const url = new URL(window.location.href);
                const subPath = url.pathname.substring(0, url.pathname.lastIndexOf("/"));
                document.cookie = "originURI=/SSO/" + (window.location.protocol === "https:" ? ";SameSite=None;Secure" : "");
				
				const returnURL = encodeURIComponent(window.location.search+window.location.hash); 
				self.location = '/SSO/login?cont='+returnURL;
            }
        </script>
        <script src="mxclientsystem/mxui/mxui.js?{{cachebust}}"></script>
    </body>
</html>

 

answered