Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Allow PKCE auth flow to preserve the user's current path to match Dex return_url capaility #20111

Closed
austin5219 opened this issue Sep 25, 2024 · 0 comments · Fixed by #20202
Closed
Labels
component:auth component:sso Issues related to Argo CD configurations component:ui User interfaces bugs and enhancements enhancement New feature or request

Comments

@austin5219
Copy link
Contributor

Summary

What change you think needs making.

The current PKCE auth flow will redirect to the authentication provider and return back to 'pkce/verify' which then calls pkceCallback and redirects the user back to '/applications' regardless of what path the user was previously at.

in ui/src/app/login/components/utils.ts

export const pkceCallback = ...

document.cookie = `argocd.token=${result.id_token}; path=/`;

window.location.replace('/applications');

This does not save the place of the user like the Dex auth flow where the return url is sent as a query param to Dex to return the user to after sso auth.

in ui/src/app/login/components/login.tsx

{href: `auth/login?return_url=${encodeURIComponent(this.state.returnUrl)}`})}

To make the two auth flows a similar user experience, the PKCE auth flow should return the user to their previous path like the Dex auth flow does.

Motivation

Please give examples of your use case, e.g. when would you use this.

This would be used in any PKCE auth flow setup for SSO for ArgoCD.

Proposal

How do you think this should be implemented?

I think the simplest way to achieve this is by caching the return url as a cookie in the pkceLogin function and reading back the cached path in the pkceCallback function which will then clean up the return url cookie or send the user to '/applications' if no return url cookie is present.

This would be similar to how the ID token is cached as a cookie after the pkce auth flow.

@austin5219 austin5219 added the enhancement New feature or request label Sep 25, 2024
@reggie-k reggie-k added component:auth component:sso Issues related to Argo CD configurations component:ui User interfaces bugs and enhancements labels Sep 26, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
component:auth component:sso Issues related to Argo CD configurations component:ui User interfaces bugs and enhancements enhancement New feature or request
Projects
None yet
2 participants