Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

When using Web Basic Authentication, users may be seen as guests #4580

Closed
TheWitness opened this issue Feb 27, 2022 · 2 comments
Closed

When using Web Basic Authentication, users may be seen as guests #4580

TheWitness opened this issue Feb 27, 2022 · 2 comments
Labels
authentication Authentication related issue/feature bug Undesired behaviour documentation Documentation issue unverified Some days we don't have a clue

Comments

@TheWitness
Copy link
Member

Describe the bug

When using basic authentication, when using certain modules include mod_auth_melon, the SAML redirection can cause the authenticated user to become a guest account instead of the intended template and or login account.

Expected behavior

Less cacti bugs.

@TheWitness TheWitness added bug Undesired behaviour documentation Documentation issue unverified Some days we don't have a clue authentication Authentication related issue/feature labels Feb 27, 2022
@netniV
Copy link
Member

netniV commented Mar 1, 2022

was this resolved?

@TheWitness
Copy link
Member Author

Yea, this was resolved. We are still tracking a redirect loop though. Basically the way that the mod_auth_melon works with redirection is, the the user hit's cacti, the user is redirected to the Azure web page where they enter their corporate credentials, and then the client is redirected back to index.php, however, when Azure does that, the HTTP_REFERER has been lost and points back to Azure instead. So, when Cacti picks up what it though was the location in Cacti to redirect to, it actually redirected back to Azure which sees that the user has valid creds, and redirects back to index.php. Until it hit's the threshold.

It would be nice if mod_auth_melon could pass the page that the user wanted to goto to the Azure service, and simply redirect back to that page. Otherwise Cacti's setting "goto where the user pointed their browser to after login" will never work.

This issue was related, but I reproduced and fixed it.

@netniV netniV changed the title When logging in as a basic authentication user, users are made "guest" accounts instead of the login accounts as expected When using Web Basic Authentication, users may be seen as guests Apr 3, 2022
@github-actions github-actions bot locked and limited conversation to collaborators Dec 1, 2022
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
authentication Authentication related issue/feature bug Undesired behaviour documentation Documentation issue unverified Some days we don't have a clue
Projects
None yet
Development

No branches or pull requests

2 participants