Uploaded image for project: 'Nuxeo Platform'
  1. Nuxeo Platform
  2. NXP-25837

Login screen config prevents SAML icon to be displayed

    XMLWordPrintable

    Details

    • Type: Bug
    • Status: Resolved
    • Priority: Minor
    • Resolution: Fixed
    • Affects Version/s: 9.10, 10.2
    • Fix Version/s: 9.10-HF25, 10.10
    • Component/s: Login Page, SAML
    • Release Notes Summary:
      SAML icon is displayed when login screen is configured.
    • Tags:
    • Backlog priority:
      500
    • Impact type:
      API change
    • Upgrade notes:
      Hide

      Added

      LoginScreenHelper#registerSingleProviderLoginScreenConfig(String name, String iconUrl, String link, String label, String description, LoginProviderLinkComputer computer)
      
      LoginScreenHelper#unregisterLoginScreenConfig(LoginScreenConfig config)
      
      LoginProviderLink(String name, String iconPath, String link, String label, String description, LoginProviderLinkComputer urlComputer)
      
      LoginScreenConfig(LoginProviderLink provider)
      
      PluggableAuthenticationService#registerLoginScreenConfig(LoginScreenConfig config)
      
      PluggableAuthenticationService#unregisterLoginScreenConfig(LoginScreenConfig config)
      

      Deprecated

      LoginScreenHelper#registerLoginProvider(String name, String iconUrl, String link, String label, String description, LoginProviderLinkComputer computer)
      
      LoginScreenConfig#registerLoginProvider(String name, String iconUrl, String link, String label, String description, LoginProviderLinkComputer computer)
      
      Show
      Added LoginScreenHelper#registerSingleProviderLoginScreenConfig( String name, String iconUrl, String link, String label, String description, LoginProviderLinkComputer computer) LoginScreenHelper#unregisterLoginScreenConfig(LoginScreenConfig config) LoginProviderLink( String name, String iconPath, String link, String label, String description, LoginProviderLinkComputer urlComputer) LoginScreenConfig(LoginProviderLink provider) PluggableAuthenticationService#registerLoginScreenConfig(LoginScreenConfig config) PluggableAuthenticationService#unregisterLoginScreenConfig(LoginScreenConfig config) Deprecated LoginScreenHelper#registerLoginProvider( String name, String iconUrl, String link, String label, String description, LoginProviderLinkComputer computer) LoginScreenConfig#registerLoginProvider( String name, String iconUrl, String link, String label, String description, LoginProviderLinkComputer computer)
    • Sprint:
      nxfit 10.10.3, nxfit 10.10.4
    • Story Points:
      3

      Description

      Reproduction scenario

      1. setup up Nuxeo in a SAML environment like in the documentation here:
        https://doc.nuxeo.com/nxdoc/saml-20-authentication/#integrating-the-nuxeo-platform-with-a-saml-20-idp
      2. keep FORM_AUTH in the authentication chain to see the button
      3. access Nuxeo login page
      4. observe the IdP button is diplayed under the login fields (see withoutBranding.png)
      5. configure branding in Studio
      6. sync with the server
      7. observe the IdP button is not displayed any longer (see withBranding.png)
      8. now remove the branding from studio
      9. sync the server
      10. now try without Studio add the following contribution (it is the same as the Studio one)
          <extension target="org.nuxeo.ecm.platform.ui.web.auth.service.PluggableAuthenticationService" point="loginScreen">
            <loginScreenConfig>
              <bodyBackgroundStyle>url("${org.nuxeo.ecm.contextPath}/img/login_bg.jpg") no-repeat center center fixed #333</bodyBackgroundStyle>
              <disableBackgroundSizeCover>false</disableBackgroundSizeCover>
              <removeNews>false</removeNews>
              <footerStyle></footerStyle>
              <loginBoxBackgroundStyle>none 0 0 null</loginBoxBackgroundStyle>
              <loginBoxWidth>300px</loginBoxWidth>
              <loginButtonBackgroundColor>#0066ff</loginButtonBackgroundColor>
              <logoUrl>${org.nuxeo.ecm.contextPath}/img/nuxeo_logo.png</logoUrl>
              <logoAlt>Nuxeo</logoAlt>
              <logoWidth>113</logoWidth>
              <logoHeight>20</logoHeight>
            </loginScreenConfig>
          </extension>
        

        to the SAML configuration XML file defined server-side.

      11. observe when it is inserted before SAML configuration, the login config is not taken into account
      12. observe when it is inserted after SAML configuration, IdP button is not visible

      Expected behavior: configuring branding should not alter the login screen

      Primary analysis

      1. the login screen is generated from the page $NUXEO_HOME/nxserver/nuxeo.war/login.jsp
        This is located into those pieces of code:
        https://github.com/nuxeo/nuxeo/blob/master/nuxeo-services/nuxeo-platform-web-common/src/main/resources/web/nuxeo.war/login.jsp#L44
        oginScreenConfig screenConfig = LoginScreenHelper.getConfig();
        List<LoginProviderLink> providers = screenConfig.getProviders();
        boolean useExternalProviders = providers!=null && providers.size()>0;

        https://github.com/nuxeo/nuxeo/blob/master/nuxeo-services/nuxeo-platform-web-common/src/main/resources/web/nuxeo.war/login.jsp#L484

                <% if (useExternalProviders) {%>
                <div class="loginOptions">
                  <p><fmt:message bundle="${messages}" key="label.login.loginWithAnotherId" /></p>
                  <div class="idList">
                    <% for (LoginProviderLink provider : providers) { %>
                    <div class="idItem">
                      <a href="<%= provider.getLink(request, request.getContextPath() + request.getParameter("requestedUrl")) %>"
                        style="background-image:url('<%=(context + provider.getIconPath())%>')" title="<%=provider.getDescription()%>"><%=provider.getLabel()%>
                      </a>
                    </div>
                    <%}%>
                  </div>
                </div>
                <%}%>
        
      2. after some debugging, the problem is the LoginScreenHelper.getProviders() method returns an empty list of providers when the login screen config is contributed
        https://github.com/nuxeo/nuxeo/blob/master/nuxeo-services/nuxeo-platform-web-common/src/main/java/org/nuxeo/ecm/platform/ui/web/auth/service/LoginScreenConfig.java#L63
      3. this should not be the case because the SAMLAuthenticationProvider is actually registering itself here:
        https://github.com/nuxeo/nuxeo/blob/master/nuxeo-services/login/nuxeo-platform-login-saml2/src/main/java/org/nuxeo/ecm/platform/auth/saml/SAMLAuthenticationProvider.java#L245
        
                    LoginScreenHelper.registerLoginProvider(parameters.get("name"), parameters.get("icon"), null,
                            parameters.get("label"), parameters.get("description"), this);
      4. it seems the LoginScreenConfig is reset for some reason but I cannot pinpoint the location

        Attachments

          Issue Links

            Activity

              People

              • Votes:
                0 Vote for this issue
                Watchers:
                3 Start watching this issue

                Dates

                • Created:
                  Updated:
                  Resolved:

                  Time Tracking

                  Estimated:
                  Original Estimate - 0 minutes
                  0m
                  Remaining:
                  Remaining Estimate - 0 minutes
                  0m
                  Logged:
                  Time Spent - 2 days
                  2d

                    PagerDuty

                    Error rendering 'com.pagerduty.jira-server-plugin:PagerDuty'. Please contact your Jira administrators.