IDP doesn't work on the .org domain #3

New Issue

oysteikt · 2018-02-13T21:05:43+01:00

pbsds commented

2018-02-13 21:05:43 +01:00

(Migrated from github.com)

I get the error message:

Caused by: SimpleSAML_Error_Exception: URL not allowed

It would be nice if you logged in on one domain, you'd stay logged in on the other as well
(cross-domain session cookie?)

I get the error message: ``` Caused by: SimpleSAML_Error_Exception: URL not allowed ``` It would be nice if you logged in on one domain, you'd stay logged in on the other as well (cross-domain session cookie?)

jornane commented

2018-02-16 13:11:08 +01:00

(Migrated from github.com)

We don't have a certificate for .org, so I'd recommend limiting logging in to the other domain.

pbsds commented

2018-08-19 22:14:28 +02:00

(Migrated from github.com)

I ended up "fixing" this one when takin the site live. All access to .org is forwarded to .ntnu.no by lighttpd. There was an issue with http aswell, which was "fixed" by having lighttpd forward the client to https

jornane commented

2018-08-20 09:39:53 +02:00

(Migrated from github.com)

See the mailing list, you should not automatically forward http to https, stuff breaks.

pbsds commented

2018-08-21 20:30:10 +02:00

(Migrated from github.com)

I've change the baseurlpath in simplesaml to use https when logging in instead, but i'd like to have the connection elevated to https when logging in, and force the session token to only be sent when the connection is secure, but this should do for now.

pbsds commented

2018-08-22 21:58:23 +02:00

(Migrated from github.com)

I've made the .org domain being forwarded to .ntnu.no when the path doesn't start with /~ (userpages).
The session cookie is only set on the .ntnu.no domain, probably due to the login url being set to that domain. This seems to have been the old solution on the old setup as well.

I've made the .org domain being forwarded to .ntnu.no when the path doesn't start with /~ (userpages). The session cookie is only set on the .ntnu.no domain, probably due to the login url being set to that domain. This seems to have been the old solution on the old setup as well.

jornane commented

2018-08-23 08:41:16 +02:00

(Migrated from github.com)

My previous fix for http/https (mailinglist) also fixed the cookie problem, so I removed the redirect.

oysteikt added the

bug

label 2024-07-28 15:38:45 +02:00

Sign in to join this conversation.