search

axelor / axelor-open-suite

The Axelor Open Suite based on Axelor Open Platform
http://axelor.com
Other
841 stars 679 forks source link

Redirect from url name to IP when SSO (Keycloak) enabled #4825

Open cyrilgt opened 4 years ago

cyrilgt commented 4 years ago

Hello, Thanks for Axelor, a great app ! After enable SSO OIDC in application.properties, the default page "https://axelor." is redirect to "http://IP:port/login.jsp" of Axelor server (in place of url domain name https://axelor./login.jsp) before contact Keycloak and the login failed (url from auth is invalid). If we force "https://axelor./login.jsp" to evict redirect in bar address, login with Keycoak is OK. We have exactly the same error with API and we can't force url. If we disable SSO OIDC in properties, the redirect from https://axelor. to https://axelor./login.jsp is OK, and API work but we don't have SSO with Keycloak :-( Regards, Cyril

pdo-axelor commented 4 years ago

Redirection to originally requested URL was fixed in Axelor Open Platform v5.2.3. Please confirm you are using framework v5.2.3 or above.

cyrilgt commented 4 years ago

I confirm, in 5.2.6 originally requested URL is working. But, API access don't work when SSO is enabled. Whith admin local account or SSO Keycloak account. Have you have any suggestions ?

pdo-axelor commented 4 years ago

When login is allowed only through SSO (exclusive mode), all external apps should log in through the SSO as well.

Otherwise, you can configure Keycloak to use OpenID Connect or OAuth 2.0, so that users may log in via either login.jsp or SSO. In that case, external apps can authenticate via the /callback endpoint instead of /login.jsp