search

ironmansoftware / powershell-universal

Issue tracker for PowerShell Universal
https://powershelluniversal.com
35 stars 2 forks source link

login won't work with SAML2 #3823

Open rstolpe opened 1 week ago

rstolpe commented 1 week ago

Version

5.0.8

Severity

Critical

Environment

msi

Steps to Reproduce

I have SAML2 with a IDP and when I'm trying to login with my breaking glass account by using PSUURL/login but now I get the following error with 5.0.8

The supplied URL is not local. A URL with an absolute path is considered local if it does not have a host/authority part. URLs using virtual paths ('~/') are also local.

With 5.0.7 it did work

Expected behavior

That /login will work without SAML2 and IDP

Actual behavior

Don't work trough error

The supplied URL is not local. A URL with an absolute path is considered local if it does not have a host/authority part. URLs using virtual paths ('~/') are also local.

Additional Environment data

No response

Screenshots/Animations

No response

adamdriscoll commented 1 week ago

Can you let me know where this is attempting to redirect to? I've tried a couple of different URLs and the SAML2 auth works and then redirects me back to the proper one.

rstolpe commented 1 week ago

@adamdriscoll it just says https://MYPSUFQDN.com/api/v1/signin/form?returnurl=

adamdriscoll commented 1 week ago

How are you hosting PSU and what OS? I have found an issue with login redirects but on Linux and not sure if that's what this is coming from.

rstolpe commented 1 week ago

I'm hosting it as is when you install it directly. Running on windows server 2022.

Load balancing with ADC (netscaler)

adamdriscoll commented 1 week ago

Thanks. I'll setup another SAML2 environment to see if I can reproduce there.

rstolpe commented 1 week ago

@adamdriscoll Today now when I'm trying to login I get this error:

No authenticationScheme was specified, and there was no DefaultChallengeScheme found. The default schemes can be set using either AddAuthentication(string defaultScheme) or AddAuthentication(Action<AuthenticationOptions> configureOptions).

Restarted PSU Service and it started to work again.

I'm only surfing to the original address https://FQDN.com

kind of strange as it did work yesterday before I did leave.

My other PSU environment with 4.4.0 works with the same SAML2 settings and IDP. Also my other 5.0.8 env.

rstolpe commented 1 week ago

Just to clarify, the original issue are still there after restarting the service

rstolpe commented 2 days ago

@adamdriscoll could you reproduce it?

rstolpe commented 1 day ago

@adamdriscoll still won't work in 5.0.9