Skip to content

Fix form/anonymous authentication when SSO is enabled

Axel Bocciarelli requested to merge fix-auth into master

I've just noticed a problem:

  1. Make sure you're logged out of SSO.
  2. Sign in as anonymous.
  3. Refresh the page.
  4. ➡ you get logged out and redirected to the /login page.

This is because matchAuthStateToSSO detects that you're logged in to ICAT but logged out of SSO, so it thinks you need to be logged out of ICAT.

if (!keycloak.authenticated && sessionId) {
  store.dispatch(doLogOut());
}

You need to be logged out only if your session was created via SSO; if you logged in as anonymous or via a login form, your SSO login status is irrelevant.

Knowing that the user has a sessionId is not sufficient. We need to make sure that the session was created via SSO, which can be done with username === null.

After adding this condition, another related problem appeared: when a user logged in as anonymous or via a login form, if they clicked on "Log out", they weren't being logged out. That's because keycloak.logout() was being called instead of dispatch(doLogOut()). The same username check fixes the problem.

Edited by Axel Bocciarelli

Merge request reports