search

maykinmedia / django-digid-eherkenning

Django library to use DigiD or eHerkenning to authenticate users
MIT License
2 stars 0 forks source link

Redirect screen contains fields, button visible to user #25

Closed LaurensBurger closed 1 year ago

LaurensBurger commented 1 year ago

image only visible for a short time, but would be nice if this is hidden

alextreme commented 1 year ago

@SonnyBA or @Bartvaderkin , if one of you wants to investigate within the context of your current project (VIPS or OIP) feel free.

alextreme commented 1 year ago

Discussed with @joeribekker and attempted on OIP acc

Note: CSP restrictions forbid inline styling so this isn't possible within the template ( https://github.com/maykinmedia/django-digid-eherkenning/blob/master/digid_eherkenning/templates/digid_eherkenning/post_binding.html ). This will require a separate css file in /static/ to hide the form.

joeribekker commented 1 year ago

Maybe for non-frontend only apps, we an make a login form/button that directly performs the post to Logius instead of the separate screen?

sergei-maertens commented 1 year ago

Maybe for non-frontend only apps, we an make a login form/button that directly performs the post to Logius instead of the separate screen?

Having skimmed through the spec and SAMLv2 with POST binding, I don't think that's even allowed or possible :grimacing:

joeribekker commented 1 year ago

If I look at mijn.haarlem.nl, they transition smoothly from login button to DigiD page without any intermediate screen.

alextreme commented 1 year ago

@joeribekker I suspect they use a different binding then, see https://en.wikipedia.org/wiki/SAML_2.0#SAML_2.0_profiles

joeribekker commented 1 year ago

Can confirm, the removal of this screen can be achieved with a different binding (redirect instead of post).