SAML login redirect url on /saml2/acs (POST)

[col-panic]

Describe the bug Logging in to bookstack via SAML2 delivers the wrong redirection url. As can be seen on the enclosed image, I receive the applications logo location as redirect url, instead of the bookstack base application url.

Nowhere within the SAML authenication system this logo url is set up. (We use keycloak)

Steps To Reproduce n/a

Expected behavior A clear and concise description of what you expected to happen.

Screenshots

Your Configuration (please complete the following information):

• Exact BookStack Version (Found in settings): 0.29.0
• PHP Version: 7.2
• Hosting Method (Nginx/Apache/Docker): docker

Additional context

[ssddanbrown]

Hi @col-panic,

Does your logo load fine when on the login page of you BookStack instance? Does the request to load the logo redirect at all?

Also, Could you confirm if you have set a STORAGE_TYPE variable in your .env or as an environment variable and, if so, confirm what STORAGE_TYPE you are currently using?

[col-panic]

hy @ssddanbrown yes - it will show the logo - but No it will not automatically redirect to the main page. That is I have to manually enter /bookstack (when I see the logo after SAML auth) to get a valid login.

Confirmed, STORAGE_TYPE=local_secure

[ssddanbrown]

@col-panic Thanks for confirming. I think that since the images on local_secure are routed through the app, BookStack will therefore store the logo request and a last app call, and then redirect you to that last app call after login. Will do some testing on my end to validate this and explore a patch.

[col-panic]

@ssddanbrown thats great - thank you!

[ssddanbrown]

Hi @col-panic, Apologies for my late reply.

I've done some deeper investigation, I don't think this is caused by what I thought it was. System images (app logo) are uploaded directly into the public space so the requests should not be routed through the application.

I have tested a keycloak SAML + secure_images setup and all works without issue.

On the ACS request shown in the screenshot, or the original login page get request, is there a Referer request header set at all? On the http response for the logo image, are cookies included in the response?

[col-panic]

Hy @ssddanbrown thanks for your response, currently I am unable to re-enact the problem, as we had a change of setup, I will further try as I can remember that the current version still had the problem!

[IntelligentesTierMaulApollo13]

I've got a similar error redirecting users to the logo file after they have successfully logged in with their LDAP username and password (Samba4 as backend).

We are on 0.30.7 now, but the problem exists since we switched to local_secure storage in v 0.30.3.

I see that the problem only exists on the first login. If I log out and log in again I don't get redirected to the logo file.

[ssddanbrown]

@IntelligentesTierMaulApollo13 Could you try re-uploading the image in the settings area? The app logo gets uploaded into public space when local_secure is active. If you've migrated then you may have moved this out of public.

I see that the problem only exists on the first login. If I log out and log in again I don't get redirected to the logo file.

I imagine the image is cached by that point so it does not have the same affect as the browser does not need to re-quest the image from BookStack.

[IntelligentesTierMaulApollo13]

@ssddanbrown Thanks a lot! That was a very quick reply. And the right one :) Re-uploading the logo file fixed it.

[ssddanbrown]

@IntelligentesTierMaulApollo13 Awesome! Glad that worked!

@col-panic I'll therefore close this since you were not able to re-enact and since it's been a couple months. If you get the issue again this can always be re-opened or feel free to create a new issue referencing this one.