Serious OIDC EspoCRM issues!
-
I quickly tested on an iPhone/Safari. It opens a new window for login. The popup does not close after login and shows some message. But the main screen logs in fine. Works fine on other browsers though (iPhone/Chrome closes the popup just fine).
I think it's best to report this upstream with screenshots explaining the problem (I can't follow up or test again since I don't have an iPhone). If someone does that, please put a link here for us to follow.
-
I quickly tested on an iPhone/Safari. It opens a new window for login. The popup does not close after login and shows some message. But the main screen logs in fine. Works fine on other browsers though (iPhone/Chrome closes the popup just fine).
I think it's best to report this upstream with screenshots explaining the problem (I can't follow up or test again since I don't have an iPhone). If someone does that, please put a link here for us to follow.
-
After 3 weeks and 3 updates waiting I decided to update again and instruct the users.
@girish there is still the issue of not being able to log out. This is also a security issue when users are sharing a PC (and that happens quite often in a small office). This issue is generic for all OIDC apps and thus a security issue for all those apps ... what do you think?
-
After 3 weeks and 3 updates waiting I decided to update again and instruct the users.
@girish there is still the issue of not being able to log out. This is also a security issue when users are sharing a PC (and that happens quite often in a small office). This issue is generic for all OIDC apps and thus a security issue for all those apps ... what do you think?
-
In a privacy tab of the browser I log into EspoCRM with OIDC and then log out from EspoCRM. You then see the log in OIDC button, when you press that you’re immediately logged in again without any credentials.
I can reproduce it in Safari and Firefox in MacOS and Safari in iOS.
-
In a privacy tab of the browser I log into EspoCRM with OIDC and then log out from EspoCRM. You then see the log in OIDC button, when you press that you’re immediately logged in again without any credentials.
I can reproduce it in Safari and Firefox in MacOS and Safari in iOS.
@imc67 said in Serious OIDC EspoCRM issues!:
when you press that you’re immediately logged in again without any credentials.
I know this doesn't really address the issue, but I guess you probably wouldn't be if you also went and logged out of the Cloudron Dashboard?
-
Generally this "auto login" happens, since the OpenID session is still active, and you have only logged out of the app, not the OpenID provider (Cloudron) There are OpenID standards to let apps also trigger a flow to optionally log out the user from the OpenID provider, however Cloudron does not yet implement those. Also support within apps is spotty. Our initial implementation had this feature, but hardly any app would behave well with this.
When sharing a browser session across users or also if one uses a public computer like in a library, this is not great, I agree and one would have to use the Cloudron dashboard logout to also kill the OpenID session. Not sure what the best angle is to improve the situation at the moment.
-
Generally this "auto login" happens, since the OpenID session is still active, and you have only logged out of the app, not the OpenID provider (Cloudron) There are OpenID standards to let apps also trigger a flow to optionally log out the user from the OpenID provider, however Cloudron does not yet implement those. Also support within apps is spotty. Our initial implementation had this feature, but hardly any app would behave well with this.
When sharing a browser session across users or also if one uses a public computer like in a library, this is not great, I agree and one would have to use the Cloudron dashboard logout to also kill the OpenID session. Not sure what the best angle is to improve the situation at the moment.
@nebulon My feeling is the way the rest of the world deals with this is making OIDC one login option, not the only login option.
So you would have the normal App's login forms, and add a [ ⬢ Cloudron ] login button injected above or below that, to take you to the Cloudron OIDC login screen and auth redirect.
Just a random example, but my feeling is that this would then enable you to have the warning on the Cloudron OIDC login, that you will stay logged in all apps logged-in this way, until you logout from Cloudron.
This also suggests the Cloudron Panel should have a page listing the logged-in apps, with a button to logout of each, or all of them.
-
There are OpenID standards to let apps also trigger a flow to optionally log out the user from the OpenID provider, however Cloudron does not yet implement those
I think maybe this is what is lacking. I see that at least on some providers like wordpress.com logout of Google does log you out despite being logged into Google.
-
@p44 I don't know about webcatalog but it works on all the main browsers now. Maybe you can report this upstream at https://github.com/espocrm/espocrm/issues/ and ask them if they want to support it.
@girish Thank's, I confirm that is working in all browsers...
Any workaround to bypass this problem on Webcatalog? @marcusquinn
-
@girish Thank's, I confirm that is working in all browsers...
Any workaround to bypass this problem on Webcatalog? @marcusquinn
@p44 My guess is something to do with the external URL Handling settings for your app or Privacy > Share browsing data between service and accounts.
-
@p44 My guess is something to do with the external URL Handling settings for your app or Privacy > Share browsing data between service and accounts.
@marcusquinn Yes.. I tried to copy and paste that url, but it seems part of a redirection process, so pasted urls seems to be not good (or expired)...
-
I imc67 referenced this topic on
