Openbravo Issue Tracking System - Openbravo ERP
View Issue Details
IDProjectCategoryView StatusDate SubmittedLast Update
0038618Openbravo ERPA. Platformpublic2018-05-16 17:312018-05-25 09:26
Reportergorkaion 
Assigned Tocaristu 
PriorityimmediateSeveritymajorReproducibilityalways
StatusclosedResolutionfixed 
PlatformOS5OS Version
Product Version 
Target Version3.0PR18Q1.4Fixed in Version3.0PR18Q1.4 
Merge Request Status
Review Assigned Toalostale
OBNetwork customer
Web browser
ModulesCore
Support ticket
Regression levelProduction - Confirmed Stable
Regression date2017-05-30
Regression introduced in release3.0PR17Q3
Regression introduced by commithttps://code.openbravo.com/erp/devel/pi/rev/624c1fa5299c [^]
Triggers an Emergency PackNo
Summary0038618: Autologon and AuthenticationManagers using SSO not working
DescriptionIf you configure an application to use the Autologon Authentication Manager the application is always redirected to the Login page.

The issue is in the index.jsp file.

It is retrieving the AD_SESSION_ID parameter and, if it is not set, it redirects to the login page.

That value is set by the Autologon and other SSO AM later when the authenticate method is executed. So these AM are always redirected to the login page.
Steps To ReproduceConfigure the Openbravo.properties to use Autologon AM:

authentication.class=org.openbravo.authentication.basic.AutologonAuthenticationManager
authentication.autologon.username=Openbravo

compile and try to access the application
Proposed SolutionProposed solution is to create a new method in the AuthenticationManager to determine if the AM is using a SSO login or not. In case of using SSO it should not redirect to the login as the session will be created in the authenticate method.

If finally an authentication is needed the authenticate method should redirect to the login page.
Additional Information
TagsNo tags attached.
Relationships
blocks defect 0038566 closed caristu Autologon and AuthenticationManagers using SSO not working 
Attached Files
Issue History
Date ModifiedUsernameFieldChange
2018-05-24 14:07caristuTypedefect => backport
2018-05-24 14:07caristuTarget Version => 3.0PR18Q1.4
2018-05-24 19:19hgbotCheckin
2018-05-24 19:19hgbotNote Added: 0104683
2018-05-24 19:19hgbotStatusscheduled => resolved
2018-05-24 19:19hgbotResolutionopen => fixed
2018-05-24 19:19hgbotFixed in SCM revision => http://code.openbravo.com/erp/backports/3.0PR18Q1.4/rev/59c5a11a1ee25742ace40ad68bea790395df1a6b [^]
2018-05-24 19:19caristuReview Assigned To => alostale
2018-05-24 19:19caristuAssigned Toplatform => caristu
2018-05-25 09:26alostaleNote Added: 0104696
2018-05-25 09:26alostaleStatusresolved => closed
2018-05-25 09:26alostaleFixed in Version => 3.0PR18Q1.4

Notes
(0104683)
hgbot   
2018-05-24 19:19   
Repository: erp/backports/3.0PR18Q1.4
Changeset: 59c5a11a1ee25742ace40ad68bea790395df1a6b
Author: Carlos Aristu <carlos.aristu <at> openbravo.com>
Date: Thu May 24 18:01:58 2018 +0200
URL: http://code.openbravo.com/erp/backports/3.0PR18Q1.4/rev/59c5a11a1ee25742ace40ad68bea790395df1a6b [^]

fixes issue 38618: Allow to skip the login page redirection done in index.jsp

After the fix for issue 0030031, it was not possible to login in Openbravo by using the authentication retrieved with an external login page. This is because in the index.jsp we first check if the DB session has been created and if not, a redirect to the login page is done.

This was breaking the flow where the authentication is performed externally and then a redirection with the result is done to directly access Openbravo, because in that case the DB session does not exists yet causing the redirection to the login page instead of granting the access into the application.

To fix this problem a new method called useExternalLoginPage() has been added to the AuthenticationManager class. It should be overridden by the subclasses that want to avoid the redirection if the DB session is not still present when trying to access into the application.

---
M src/index.jsp
M src/org/openbravo/authentication/AuthenticationManager.java
M src/org/openbravo/authentication/basic/AutologonAuthenticationManager.java
---
(0104696)
alostale   
2018-05-25 09:26   
tested + reviewed