[BUG] SAML nextUrl is empty when clicking on the Button Log in with single sign-on

[joshuarrrr]

@marcohald commented on Tue May 23 2023

Describe the bug

The Session expires and the User is redirected back to the Login Page.
There he can login via the Form based Authentification or use SAML with "Log in with single sign-on"
When SAML is used the nextUrl is set to / instead of the URL that is already passed to the logon site

To Reproduce
Steps to reproduce the behavior:

1. Configure SAML and set this in the Config

opensearch_security.auth.type: ["basicauth","saml"]
server.xsrf.allowlist: ["/_opendistro/_security/saml/acs", "/_opendistro/_security/saml/logout"]
opensearch_security.auth.multiple_auth_enabled: true

2. Login and visit the Discover Site and add any Filters

3. Delete the Cookies for the Site

4. Click on Something on the Site and you are redirected to the Login Page
   

5. In the Browser URL Bar the nextUrl is set on the Button you can see in the bottom left of the Screenshot the nextUrl is set to /

Expected behavior
The Button "Log in with single sign-on" should have the same nextUrl set as the site itself

OpenSearch Version
v 2.7.0
Dashboards Version
v 2.7.0

Plugins
opensearch-alerting
opensearch-anomaly-detection
opensearch-asynchronous-search
opensearch-cross-cluster-replication
opensearch-geospatial
opensearch-index-management
opensearch-job-scheduler
opensearch-knn
opensearch-ml
opensearch-neural-search
opensearch-notifications
opensearch-notifications-core
opensearch-observability
opensearch-performance-analyzer
opensearch-reports-scheduler
opensearch-security
opensearch-security-analytics
opensearch-sql

Host/Environment (please complete the following information):

• OS: Windows 10
• Browser and version Firefox 113

---

@joshuarrrr commented on Tue May 23 2023

@opensearch-project/triage Please transfer to https://github.com/opensearch-project/security-dashboards-plugin

---

@marcohald commented on Tue May 23 2023

@joshuarrrr Should I create the Issue manually at https://github.com/opensearch-project/security-dashboards-plugin
and close this one or is that somehow automated?

---

@joshuarrrr commented on Tue May 23 2023

Hi @marcohald - there are project maintainers in that group that have the permissions to transfer issues (which I don't). So in theory they should transfer it. But if there's no action by tomorrow I'll move it over for you.

---

@DarshitChanpura commented on Wed May 24 2023

Hey @joshuarrrr I'm a maintainer of security-dashboards-plugin and part of @opensearch-project/triage, however i do not have permissions to transfer this issue.

---

@joshuarrrr commented on Wed May 24 2023

OK, I'll just transfer via zenhub