sendnrw/netbird
2
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-08-25 00:51:28 +02:00
Code Issues Packages Projects Releases Wiki Activity

[client] Respect DisablePromptLogin when extending the auth session

Browse Source 
Forcing prompt=login on a session extend overrode DisablePromptLogin, which
is set for IdPs that break on it: Authentik triggers a double authentication
and social logins fail outright. Overriding it there trades a recoverable
extend for a login that cannot complete at all.

Keep the LoginFlag override, which only replaces max_age=0 or none with
prompt=login so the IdP honours login_hint, and leave DisablePromptLogin as
configured. Those deployments keep the silent flow, and with several accounts
signed in an extend answered from the wrong one still fails the user match.
This commit is contained in:
Zoltán Papp
2026-08-18 02:12:07 +02:00
parent 9e9e33ae68
commit 70ef1d2f25
2 changed files with 37 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files

40
management/internals/shared/grpc/pkce_flow_test.go
View File

@@ -17,18 +17,6 @@ func TestApplySessionExtendFlowPolicy(t *testing.T) {
disablePromptLogin bool
loginFlag uint32
}{
{
name: "extend forces prompt=login over a silent flow",
flow: &proto.PKCEAuthorizationFlow{
ProviderConfig: &proto.ProviderConfig{
DisablePromptLogin: true,
LoginFlag: uint32(common.LoginFlagMaxAge0),
},
},
sessionExtend: true,
disablePromptLogin: false,
loginFlag: uint32(common.LoginFlagPromptLogin),
},
{
name: "extend replaces max_age=0 so login_hint is honoured",
flow: &proto.PKCEAuthorizationFlow{
@@ -42,17 +30,41 @@ func TestApplySessionExtendFlowPolicy(t *testing.T) {
loginFlag: uint32(common.LoginFlagPromptLogin),
},
{
name: "login keeps the configured flow untouched",
name: "extend replaces the none flag so the extend is not silent",
flow: &proto.PKCEAuthorizationFlow{
ProviderConfig: &proto.ProviderConfig{
DisablePromptLogin: false,
LoginFlag: uint32(common.LoginFlagNone),
},
},
sessionExtend: true,
disablePromptLogin: false,
loginFlag: uint32(common.LoginFlagPromptLogin),
},
{
name: "extend respects DisablePromptLogin",
flow: &proto.PKCEAuthorizationFlow{
ProviderConfig: &proto.ProviderConfig{
DisablePromptLogin: true,
LoginFlag: uint32(common.LoginFlagMaxAge0),
},
},
sessionExtend: false,
sessionExtend: true,
disablePromptLogin: true,
loginFlag: uint32(common.LoginFlagMaxAge0),
},
{
name: "login keeps the configured flow untouched",
flow: &proto.PKCEAuthorizationFlow{
ProviderConfig: &proto.ProviderConfig{
DisablePromptLogin: false,
LoginFlag: uint32(common.LoginFlagMaxAge0),
},
},
sessionExtend: false,
disablePromptLogin: false,
loginFlag: uint32(common.LoginFlagMaxAge0),
},
}
for _, tc := range tests {

14
management/internals/shared/grpc/server.go
View File

@@ -1252,16 +1252,24 @@ func (s *Server) GetPKCEAuthorizationFlow(ctx context.Context, req *proto.Encryp
// prompt=login the IdP honours login_hint and offers the peer's own account,
// whereas max_age=0 leaves the user to find it among every account signed in.
//
// DisablePromptLogin is left alone. It is set for IdPs that break on
// prompt=login — Authentik triggers a double authentication, and social logins
// fail outright — so overriding it would trade a recoverable session extend for
// a login that cannot complete at all. Those deployments keep the silent flow
// and, with several accounts signed in, an extend answered from the wrong one
// still fails the user match.
//
// Called after ValidateFlowResponse so that a per-peer override cannot reinstate
// the silent flow for an extend.
func applySessionExtendFlowPolicy(flow *proto.PKCEAuthorizationFlow, sessionExtend bool) {
if !sessionExtend {
return
}
if cfg := flow.GetProviderConfig(); cfg != nil {
cfg.DisablePromptLogin = false
cfg.LoginFlag = uint32(common.LoginFlagPromptLogin)
cfg := flow.GetProviderConfig()
if cfg == nil || cfg.GetDisablePromptLogin() {
return
}
cfg.LoginFlag = uint32(common.LoginFlagPromptLogin)
}
// SyncMeta endpoint is used to synchronize peer's system metadata and notifies the connected,