search

TAMULib / SAGE

Search Aggregation Engine
MIT License
6 stars 2 forks source link

Properly support anononymous account with token or not at all. #464

Closed kaladay closed 1 year ago

kaladay commented 1 year ago

Describe the bug A bug where the token is created while user is anonymous was exposed and observed while resolving https://github.com/TAMULib/Weaver-UI-Core/issues/217.

A valid token gets generated. Something went wrong with the process and the authentication fails. An error gets stuck on the screen no matter how many page refreshes so long as the token cookie exists and the user is anonymous (has ROLE_ANONYMOUS).

The immediately implemented solution has been to delete the token on login problems.

This is either a bug such that the error message is being displayed and should not when a token is created. In this case the functionality for keeping the token for anonymous users should be removed.

Or this is an incomplete feature that needs to be completed. If this is an incomplete feature, then the solution linked above would also need to be removed. The feature should assure that an error message does not appear when an user with ROLE_ANONYMOUS has a token. Additional work is necessary in regards to when authentication doesn't fully complete but a token exists. In this case a token is probably invalid. This needs consideration.

Treating this as a bug and not maintaining the token might be the simplest and shortest route to resolution of this issue.

This might need to be solved in or require changes in weaver-webservice-core.

To Reproduce Steps to reproduce the behavior:

  1. Make sure on a branch that doesn't include the fix that deletes the token for anonymous users.
  2. Set AUTH_SERVICE_URL=https://labs.library.tamu.edu/authfix on a project, such as SAGE.
  3. Start docker.
  4. Attempt to login.
  5. See error

Expected behavior No error appears and:

  1. There is no token for the anonymous user (when treating this as a bugfix).
  2. There is a token for anonymous user on non-authentication (when treating this as a feature) (How does one get an anonymous token without logging in?).
  3. There is no token for anonymous user on authentication failure (when treating this as a feature) (Does it make sense to have a token when login attempt fails?).

Additional context see: https://github.com/TAMULib/SAGE/blob/main/src/main/java/edu/tamu/sage/auth/service/AppUserCredentialsService.java#L17

jcreel commented 1 year ago

Fixed with https://github.com/TAMULib/Weaver-UI-Core/pull/218. Thanks, Kevin.