search

cdaecke / md_saml

TYPO3 SSO Login with SAML authentication
Other
2 stars 9 forks source link

Missing handling of requestToken in TYPO3 v12 #10

Closed julianhofmann closed 7 months ago

julianhofmann commented 8 months ago

The return to TYPO3 (or the authentication there) fails due to the missing requestToken in TYPO3 v12.

However, this is possibly already being clarified at StackOverflow.... https://stackoverflow.com/questions/77866083/custom-backend-authentication-service-in-typo3-v12

cdaecke commented 8 months ago

@julianhofmann Thanks a lot for pointing this out! A first fix is added.

The backend login is working now with TYPO3 v12, but I get redirected to /typo3/login. Only when I remove the login from the Url afterwards, I get the TYPO3 backend. Don't know why this happens and have to investigate a little more.

If you have any ideas, I would be happy, to get pointed into the right direction ;-)

cdaecke commented 8 months ago

I did some research now. Debugging the returning requests from the ADFS server shows the following:

  1. Post request from ADFS server back to the TYPO3 URL. It sets a cookie and redirects.

    01

  2. Request to the TYPO3 backend. This deletes the cookie (is this correct??) and redirects again.

    02

  3. Request to the login screen, creating the correct login with setting the cookie

    03

After removing the /login from the URL, the TYPO3 backend is shown correctly.

@julianhofmann I have no clue what happens here. Do you know, what goes wrong? Any hint is appreciated very much!

ghanshyam-drc commented 8 months ago

Just hint, im not sure. This could be issue with PSR. It has no explicit interface so it wont send Set-Cookie with server response header. Possible solution is either use some external lib which allow to send secure cookie (Se-cookie) with response header or build own header.

cdaecke commented 7 months ago

Sometimes I have to have a break and do other things. Just in this moments I get new ideas and this time I had to remember the following from my own documentation: In "LocalConfiguration.php" or "AdditionalConfiguration.php" the "['BE']['cookieSameSite']"" must be set to "lax". After doing so, the login worked perfektly fine! :-)