fix(login): honour x509Enabled and iconUrl on the login page#806
Conversation
The login page gated the OIDC and userpass buttons on their respective flags but rendered x509 unconditionally, so a deployment that authenticates only via OIDC had no way to hide it. x509Enabled was already plumbed from the environment through the gateway, DTO, use case and presenter into the view model, and then never read by the component. X509_ENABLED was also missing from the env-generator: it was harvested from the environment but dropped by the .env template, so the value never reached the app. Emit it, and add the matching default alongside the other login flags. Note this is a behaviour change for anyone who already set X509_ENABLED=False expecting it to work: the button now actually disappears. Deployments that never set it are unaffected, as the flag defaults to true.
OIDC_PROVIDER_<NAME>_ICON_URL was read by the gateway, emitted by the .env template and populated onto OIDCProvider.iconUrl, but every OIDC button hardcoded the same MdAccountCircle, leaving the setting unreachable. Render the configured icon, keeping MdAccountCircle as the fallback when none is set. Uses a plain <img> rather than next/image: the icon URL is operator supplied at deploy time, so its host cannot be allow-listed in next.config's images.remotePatterns.
|
Thanks @Soap2G. Can you update the corresponding story files for the login page ? |
…o#805 Add a BOIDCOnlyLogin story showing a deployment where userpass and x509 are both off, so the configured providers are the only login options, and give the story's Indigo IAM provider an iconUrl so the branded and fallback icons render side by side. The icon is served from ../public via staticDirs, keeping the published Storybook independent of remote hosts. Also add the matching component test for iconUrl, so both fixes in this branch carry regression coverage. Note ABasicLogin in 01_0_Login_MultiVO already sets x509Enabled: false and previously rendered the button regardless; it now shows userpass only, which is what the story always claimed to demonstrate.
|
Hi @maany, done. There's now a |
|
@Soap2G Thanks! Could you also update the containers to download the image locally and serve this locally via next image, that is indeed the correct way to do this. |
|
@Soap2G I am taking this over and will make a release shortly |
|
Thanks @maany!! I thought that somehow it would have been linked.. |
|
I've pushed two commits onto this branch to serve the OIDC provider icons locally via
The container side that downloads each icon into Note: provider names are upper-cased to form the filename on both sides, so the container and gateway always agree. Icons should be raster (png/jpg), matching the community-logo constraint. |
2 participants
Closes #805.
1. The x509 button can now be disabled
Login.tsxgated the OIDC and userpass buttons on their flags but rendered x509anyways.
Also,
X509_ENABLEDwas harvested by the env-generator but never emitted by.env.liquid.Kind of important:
X509_ENABLEDis opt-out.Deployments that never set it are unaffected. Anyone who did set
X509_ENABLED=Falseexpecting it to work will now see the button disappear.
2.
iconUrlis now renderedOIDC_PROVIDER_<NAME>_ICON_URLis read by the gateway, emitted by.env.liquidand populated onto
OIDCProvider.iconUrl, but every OIDC button hardcoded thesame
MdAccountCircle, leaving the setting unreachable.One question/comment for @maany: this uses a plain
<img>rather thannext/image,because the icon URL is provided at deploy time and its host therefore
cannot be allow-listed in
next.config'simages.remotePatterns.The alternative would be to follow the
community_logo_urlprecedent andserve locally via
next/image; that needs arucio/containerschange andwould have to handle one icon per provider. Happy to switch if you prefer that.
Testing
test/component/Login.test.tsxasserting the x509 buttonis missing when
x509Enabled: false, and that userpass/OIDC are unaffected.Verified it fails against unpatched
Login.tsxand passes with the fix.