Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Preserve original URL after logout caused by session timeout for all supported authentication providers #70398

Closed
azasypkin opened this issue Jul 1, 2020 · 1 comment · Fixed by #84229
Labels
blocked enhancement New value added to drive a business result Feature:Security/Authentication Platform Security - Authentication Team:Security Team focused on: Auth, Users, Roles, Spaces, Audit Logging, and more!

Comments

@azasypkin
Copy link
Member

azasypkin commented Jul 1, 2020

Currently we preserve original URL only for basic/token authentication providers (#57157), but we don't do this for others (SAML, OpenID Connect, Kerberos, PKI). The main reason is that supporting this for SSO is a bit tricky when Single Logout is used and user is redirected back and forth between Identity Provider (IdP) and Kibana.

There are a number of places where we can lose original URL and hence we need a reliable way to store it somewhere: IdP drops it if we try to store it in the URL like we do for basic/token, we may hit cookie size limit (~4KB, and Kibana URLs are very long usually) if we store it in the cookie, keeping it in the session/local browser storage would make it hard to retrieve it on the server side where we validate redirect URLs etc. The plan is to store it in the session index we'll introduce in #17870. Another prerequisite is #69506.

Note: Logged Out view should be able to deal with next parameter.

Blocked by: #17870, #69506

@azasypkin azasypkin added blocked Team:Security Team focused on: Auth, Users, Roles, Spaces, Audit Logging, and more! enhancement New value added to drive a business result Feature:Security/Authentication Platform Security - Authentication labels Jul 1, 2020
@elasticmachine
Copy link
Contributor

Pinging @elastic/kibana-security (Team:Security)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
blocked enhancement New value added to drive a business result Feature:Security/Authentication Platform Security - Authentication Team:Security Team focused on: Auth, Users, Roles, Spaces, Audit Logging, and more!
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants