From fa27255dd78439959e35af3e075d161aeb0b26d5 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Adri=C3=A1n=20Jes=C3=BAs=20Pe=C3=B1a=20Rodr=C3=ADguez?= Date: Fri, 11 Jul 2025 09:22:38 +0200 Subject: [PATCH] chore(saml): redirect to login page on fail (#8247) --- api/src/backend/api/tests/test_views.py | 10 ++++++---- api/src/backend/api/v1/views.py | 12 +++++++----- 2 files changed, 13 insertions(+), 9 deletions(-) diff --git a/api/src/backend/api/tests/test_views.py b/api/src/backend/api/tests/test_views.py index dbfcabf207..b064ee352f 100644 --- a/api/src/backend/api/tests/test_views.py +++ b/api/src/backend/api/tests/test_views.py @@ -5978,7 +5978,8 @@ class TestSAMLConfigurationViewSet: @pytest.mark.django_db class TestTenantFinishACSView: - def test_dispatch_skips_if_user_not_authenticated(self): + def test_dispatch_skips_if_user_not_authenticated(self, monkeypatch): + monkeypatch.setenv("AUTH_URL", "http://localhost") request = RequestFactory().get( reverse("saml_finish_acs", kwargs={"organization_slug": "testtenant"}) ) @@ -5999,7 +6000,8 @@ class TestTenantFinishACSView: assert response.status_code in [200, 302] - def test_dispatch_skips_if_social_app_not_found(self, users_fixture): + def test_dispatch_skips_if_social_app_not_found(self, users_fixture, monkeypatch): + monkeypatch.setenv("AUTH_URL", "http://localhost") request = RequestFactory().get( reverse("saml_finish_acs", kwargs={"organization_slug": "testtenant"}) ) @@ -6037,7 +6039,7 @@ class TestTenantFinishACSView: "firstName": ["John"], "lastName": ["Doe"], "organization": ["testing_company"], - "userType": ["saml_default_role"], + "userType": ["no_permissions"], }, ) @@ -6091,7 +6093,7 @@ class TestTenantFinishACSView: assert user.name == "John Doe" assert user.company_name == "testing_company" - role = Role.objects.using(MainRouter.admin_db).get(name="saml_default_role") + role = Role.objects.using(MainRouter.admin_db).get(name="no_permissions") assert role.tenant == tenants_fixture[0] assert ( diff --git a/api/src/backend/api/v1/views.py b/api/src/backend/api/v1/views.py index b78df96857..4f7075ff78 100644 --- a/api/src/backend/api/v1/views.py +++ b/api/src/backend/api/v1/views.py @@ -560,10 +560,11 @@ class SAMLConfigurationViewSet(BaseRLSViewSet): class TenantFinishACSView(FinishACSView): def dispatch(self, request, organization_slug): - response = super().dispatch(request, organization_slug) + super().dispatch(request, organization_slug) user = getattr(request, "user", None) if not user or not user.is_authenticated: - return response + callback_url = env.str("AUTH_URL") + return redirect(f"{callback_url}?sso_saml_failed=true") # Defensive check to avoid edge case failures due to inconsistent or incomplete data in the database # This handles scenarios like partially deleted or missing related objects @@ -585,7 +586,8 @@ class TenantFinishACSView(FinishACSView): SocialAccount.DoesNotExist, User.DoesNotExist, ): - return response + callback_url = env.str("AUTH_URL") + return redirect(f"{callback_url}?sso_saml_failed=true") extra = social_account.extra_data user.first_name = ( @@ -607,9 +609,9 @@ class TenantFinishACSView(FinishACSView): .tenant ) role_name = ( - extra.get("userType", ["saml_default_role"])[0].strip() + extra.get("userType", ["no_permissions"])[0].strip() if extra.get("userType") - else "saml_default_role" + else "no_permissions" ) try: role = Role.objects.using(MainRouter.admin_db).get(