New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 624751 link

Starred by 1 user

Issue metadata

Status: Duplicate
Owner: ----
Closed: Jul 2016
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Windows
Pri: 3
Type: Bug



Sign in to add a comment

SAML signin issue - two request made to IdP

Project Member Reported by djeche@chromium.org, Jun 30 2016

Issue description

Chrome Version       : 51.0.2704.103 (Official Build) m (64-bit)
URLs (if applicable) : chrome://chrome-signin/?access_point=10&reason=0&constrained=0&frameUrlId=1&auto_close=1&showAccountManagement=1&force_keep_data=1 
Other browsers tested: Other browsers are not applicable in this instance

What steps will reproduce the problem?
(1) Click on the top right hand side where login in user is usually defined.(see image login-localtion.png)
(2) Once you click on there you need to click on "sign in to Chrome"(see image login-localtion.png). 
(3) A pop up windows appears. Here type in the username to be redirected via a new tab to the SAML page(see image new-tab-saml.png).
(4) Once on the SAML page if you enter in credentials, you are authenticated then redirected back to google(Please see video demo client-saml.swf).
(5) When redirected to google a page stating please wait a moment is shown and it never finishes loading.

What is the expected result?

The excepted results if for the SAML process to complete the signing in process. 


What happens instead?

The login process hangs at after the user has authenticated them selfs. It appears as though the new session is not tied to the initial login process. There are two requests made. 

The new tab that is open does not seem to have relationship with initial login process. It might be that since a new tab means a new process it can read or write in to the main browser process space.


Please provide any additional information below. Attach a screenshot if
possible.

So there are a number of workaround for this.

You can disable  
KEY POINTS: 
- If the customer navigates directly to chrome://chrome-signin or remove the frameUrlId=1 from the URL string, the sign-in process works normally. 
- If the customer disables "Enable new gaia password-separated sign in flow" from "chrome://flags", the sign-in process works normally. 
- Entering the password in the first initial window(see image saml-orginal-page.png) will log you in irregardless of flags configuration. When logging in this way multiple tabs white paged tabs are spawned. The saml server also throws the following error. The login succeeds though:

SimpleSAML_Error_BadRequest: BADREQUEST('%REASON%' => 'Missing AuthState parameter.')
Backtrace:
1 /var/simplesamlphp/modules/privacyidea/www/loginform.php:15 (require)
0 /var/simplesamlphp/www/module.php:134 (N/A)


Capture files provided from customer environment. There is a net internals file, fiddler capture file, debug logs and video of the issue occurring. 

https://drive.google.com/a/google.com/folderview?id=0B9BQIK7d0CYNM3VHNFFjTXZvVFE&usp=sharing

I have cced everyone who worked on 57001. This bug is very similar.

 
Yes, this is similar to  Issue 571001 . However, I'm worried by the fact that turning off the password separated sign in flow fixes the issue. It means we might be doing something wrong in Chrome but it might also mean that the new GAIA endpoint doesn't handle SAML sign in properly.

Do we have a SAML account to use for testing that this repro's on?

Comment 2 by kotah@chromium.org, Jul 12 2016

Mergedinto: 624042
Status: Duplicate (was: Untriaged)
This actually seems to be dup of crbug.com/624042.

crbug.com/624042 is also about SSO sign-in from person icon gets stuck with "One moment please...", and can be avoided by disabling chrome://flags/#enable-password-separated-signin-flow.

@anthonyvd, I can share repro test user accounts with you if needed.

Sign in to add a comment