TheArchive/zitadel
1
0
Fork 0
mirror of https://github.com/zitadel/zitadel.git synced 2025-11-16 15:14:59 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(login): allow fallback to local auth in case of IdP errors (#9178)

Browse Source 
# Which Problems Are Solved

The current login will always prefer external authentication (through an
IdP) over local authentication. So as soon as either the user had
connected to an IdP or even when the login policy was just set up to
have an IdP allowed, users would be redirected to that IdP for
(re)authentication.
This could lead to problems, where the IdP was not available or any
other error occurred in the process (such as secret expired for
EntraID).
Even when local authentication (passkeys or password) was allowed for
the corresponding user, they would always be redirected to the IdP
again, preventing any authentication. If admins were affected, they
might not even be able to update the client secret of the IdP.

# How the Problems Are Solved

Errors during the external IdP flow are handled in an
`externalAuthFailed` function, which will check if the organisation
allows local authentication and if the user has set up such.
If either password or passkeys is set up, the corresponding login page
will be presented to the user. As already with local auth passkeys is
preferred over password authentication.
The user is informed that the external login failed and fail back to
local auth as an error on the corresponding page in a focused mode. Any
interaction or after 5 second the focus mode is disabled.

# Additional Changes

None.

# Additional Context

closes #6466
This commit is contained in:
Livio Spring
2025-01-15 11:39:28 +01:00
committed by GitHub
parent 1949d1546a
commit 40082745f4
59 changed files with 388 additions and 195 deletions
Download Patch File Download Diff File Expand all files Collapse all files

33
internal/api/ui/login/renderer.go
View File

@@ -341,7 +341,6 @@ func (l *Login) chooseNextStep(w http.ResponseWriter, r *http.Request, authReq *
}
func (l *Login) renderInternalError(w http.ResponseWriter, r *http.Request, authReq *domain.AuthRequest, err error) {
var msg string
if err != nil {
log := logging.WithError(err)
if authReq != nil {
@@ -352,17 +351,15 @@ func (l *Login) renderInternalError(w http.ResponseWriter, r *http.Request, auth
} else {
log.Info()
}
_, msg = l.getErrorMessage(r, err)
}
translator := l.getTranslator(r.Context(), authReq)
data := l.getBaseData(r, authReq, translator, "Errors.Internal", "", "Internal", msg)
data := l.getBaseData(r, authReq, translator, "Errors.Internal", "", err)
l.renderer.RenderTemplate(w, r, translator, l.renderer.Templates[tmplError], data, nil)
}
func (l *Login) getUserData(r *http.Request, authReq *domain.AuthRequest, translator *i18n.Translator, titleI18nKey string, descriptionI18nKey string, errType, errMessage string) userData {
func (l *Login) getUserData(r *http.Request, authReq *domain.AuthRequest, translator *i18n.Translator, titleI18nKey string, descriptionI18nKey string, err error) userData {
userData := userData{
baseData: l.getBaseData(r, authReq, translator, titleI18nKey, descriptionI18nKey, errType, errMessage),
baseData: l.getBaseData(r, authReq, translator, titleI18nKey, descriptionI18nKey, err),
profileData: l.getProfileData(authReq),
}
if authReq != nil && authReq.LinkingUsers != nil {
@@ -371,7 +368,7 @@ func (l *Login) getUserData(r *http.Request, authReq *domain.AuthRequest, transl
return userData
}
func (l *Login) getBaseData(r *http.Request, authReq *domain.AuthRequest, translator *i18n.Translator, titleI18nKey string, descriptionI18nKey string, errType, errMessage string) baseData {
func (l *Login) getBaseData(r *http.Request, authReq *domain.AuthRequest, translator *i18n.Translator, titleI18nKey string, descriptionI18nKey string, err error) baseData {
title := ""
if titleI18nKey != "" {
title = translator.LocalizeWithoutArgs(titleI18nKey)
@@ -383,10 +380,16 @@ func (l *Login) getBaseData(r *http.Request, authReq *domain.AuthRequest, transl
}
lang, _ := l.renderer.ReqLang(translator, r).Base()
var errID, errMessage string
var errPopup bool
if err != nil {
errID, errMessage, errPopup = l.getErrorMessage(r, err)
}
baseData := baseData{
errorData: errorData{
ErrID: errType,
ErrID: errID,
ErrMessage: errMessage,
ErrPopup: errPopup,
},
Lang: lang.String(),
Title: title,
@@ -482,14 +485,17 @@ func (l *Login) setLinksOnBaseData(baseData baseData, privacyPolicy *domain.Priv
return baseData
}
func (l *Login) getErrorMessage(r *http.Request, err error) (errID, errMsg string) {
func (l *Login) getErrorMessage(r *http.Request, err error) (errID, errMsg string, popup bool) {
idpErr := new(IdPError)
if errors.Is(err, idpErr) {
popup = true
}
caosErr := new(zerrors.ZitadelError)
if errors.As(err, &caosErr) {
localized := l.renderer.LocalizeFromRequest(l.getTranslator(r.Context(), nil), r, caosErr.Message, nil)
return caosErr.ID, localized
localized := l.renderer.LocalizeFromRequest(l.getTranslator(r.Context(), nil), r, caosErr.Message, map[string]interface{}{"Details": caosErr.Parent})
return caosErr.ID, localized, popup
}
return "", err.Error()
return "", err.Error(), popup
}
func (l *Login) getTheme(r *http.Request) string {
@@ -662,6 +668,7 @@ type baseData struct {
type errorData struct {
ErrID string
ErrMessage string
ErrPopup bool
}
type userData struct {