Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Fix identity provider login page not found due to missing permission #4795

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
spencern merged 1 commit into from
Nov 29, 2018
Merged

Fix identity provider login page not found due to missing permission #4795

spencern merged 1 commit into from
Nov 29, 2018

Conversation

@impactmass
Copy link
Contributor

@impactmass impactmass commented Nov 7, 2018 •
edited
Loading

Resolves #4794
Impact: major
Type: bugfix

Issue

OAuth IDP login pages created by the Hydra plugin are not showing up after recent updates. So /account/login returns Not Found.

This started happening after the permission update to Package routes publication.

Solution

Add the permission for the Hydra plugin to guest groups. This allows the route to be published for anyone visitor to the meteor app trying to login from the Starterkit.

This should be done for plugins that add public routes.

Breaking changes

N/A

No migration needed.

Testing

  1. Start up Starterkit (develop), Hydra (master) and Reaction API (this branch)
  2. On the Starterkit, try to login (i.e click the login button)
  3. You should be redirected to the Meteor app; and you should be able to see the login form (that's the fix).
  4. Test this in incognito as well.

Docs

I'll go through the docs and creating a public that adds a public route. It should say that the permission for the plugin needs to be granted to anonymous users, otherwise the route will not be accessible to non-admin users.

Update: In fact, there is no docs concern. Because in a post 2.0 world, our process now is that UI should be driven separately from the API (as seen in the warning message here

@impactmass impactmass changed the title WIP - Fix identity provider login page not found due to missing permission Fix identity provider login page not found due to missing permission Nov 7, 2018
@impactmass impactmass requested a review from mikemurray November 7, 2018 14:32
@impactmass impactmass self-assigned this Nov 7, 2018
@impactmass
Copy link
Contributor Author

impactmass commented Nov 12, 2018

@mikemurray here's a reminder to check this PR.

@impactmass
Copy link
Contributor Author

impactmass commented Nov 13, 2018 •
edited
Loading

@mikemurray your finding about getting the not-found page after a reset is true. I can confirm it. It shows a fault in the way startup events happen when a reset happens.

I think it needs to be sorted out separately. I don't know if it's a recent regression, but should not block this PR

The afterCoreInit is the specified way all plugins add new roles to groups at this point, so it's likely affecting others too.

@mikemurray
Copy link
Member

mikemurray commented Nov 13, 2018 •
edited
Loading

@impactmass If afterCoreInit is having issues then this PR should be blocked by that issue since it would require someone to start reaction twice before it works.

Also, the permission issue can still be overcome by going into the Accounts panel and enabling OAuth login for both "Customer" and "Guest".

@impactmass impactmass changed the base branch from release-2.0.0-rc.6 to release-2.0.0-rc.7 November 15, 2018 10:36
@pmn4
Copy link
Collaborator

pmn4 commented Nov 21, 2018

Hey y'all, what is the status of this?
I recently started developing on RC Platform (using the master branch) and am blocked by this issue. I have been forced to work only on publicly facing features (since I cannot even log in as the owner to add products or update settings)

thanks!

@spencern
Copy link
Contributor

spencern commented Nov 28, 2018

@pmn4 @mikemurray @impactmass
I see the blocked label has been added here, can we connect the issue that's blocking this to the ticket? Is anyone actively working on the blocking issue right now?

mikemurray
mikemurray requested changes Nov 28, 2018
View reviewed changes
Copy link
Member

@mikemurray mikemurray left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This PR is blocked by the fact that afterCoreInitonly triggers after you start reaction once, stop then start again.

afterCoreInit will need to be looked at to see why it doesn't trigger when you think it's supposed to.

@mikemurray
Copy link
Member

mikemurray commented Nov 28, 2018

@pmn4 What's causing you to not be able to sign in? The Hydra OAuth page is primarily used for the starter-kit for auth.

@mikemurray
Copy link
Member

mikemurray commented Nov 28, 2018

@spencern it seems like this PR #4795 is attempting to address the issue of why afterCoreInit in this PR seems to take 2 runs to take hold.

TL;DR it seems to be migration 5

@brent-hoover
Copy link
Collaborator

brent-hoover commented Nov 28, 2018

@mikemurray I'm pretty sure that Pat is trying to migrate his site to 2.0/starter-kit

@pmn4
Copy link
Collaborator

pmn4 commented Nov 28, 2018

it's true that I am migrating, however, I simply cloned the platform repo, started it up and was unable to login.
I have been focusing on recreating my onboarding experience in the meantime, but will need to be able to login very shortly. (I'm happy to rollback the reaction repo a few commits, but would rather roll forward)

@impactmass
Copy link
Contributor Author

impactmass commented Nov 28, 2018

@spencern I'd say "blocked" was the wrong label, the issue needed a deeper look and I wasn't actively working on it after that point, but @dancastellon just opened PR #4835 to tackled this issue as well.

He tracked it down to a migration problem. See thread on #4835

@spencern spencern merged commit 0be6269 into release-2.0.0-rc.7 Nov 29, 2018
@spencern
Copy link
Contributor

spencern commented Nov 30, 2018

@impactmass I don't remember merging this though GitHub says I did. I merged #4835 - should this be reverted?

@mikemurray
Copy link
Member

mikemurray commented Nov 30, 2018

@spencern I think it might not be a big deal since it's adding reaction-hydra-oauth permission which is the parent permission of account/login that was added in PR #4835.

@impactmass
Copy link
Contributor Author

impactmass commented Nov 30, 2018 •
edited
Loading

I think GitHub closed this as a merged PR because the other PR you merged was branched off the branch here. I've checked rc-7 branch and the changes there looked good.

@impactmass impactmass deleted the fix-4794-impactmass-idp-route-notfound branch November 30, 2018 09:55
@janus-reith
Copy link
Collaborator

janus-reith commented Dec 6, 2018

Im experiencing the same issue on a fresh checkout of reacttion-platform, with 2.0.0-rc.7 pulled.

Only change I made is modifying the docker-compose file to make sure that the volume for the mongo container is unique.

@impactmass
Copy link
Contributor Author

impactmass commented Dec 6, 2018 •
edited
Loading

Hi @janus-reith, this fix did not go out with the rc-7 release. This fix was merged into the rc-7 branch shortly after we already released rc-7 as a security patch.

It will be published with the rc-8 release. If you want to test it out right now you can use the rc-8 branch.

@spencern
Copy link
Contributor

spencern commented Dec 10, 2018

The merged to release-2.0.0-rc.7 is misleading here because we had a planned release for rc.7 and ended up releasing rc.7 as a security patch and changing the planned release to rc.8

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@mikemurray mikemurray mikemurray requested changes

Assignees

@impactmass impactmass

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

7 participants

@impactmass @mikemurray @pmn4 @spencern @brent-hoover @janus-reith