Description of problem: Fedora have made it so you can no longer embed the login so this will no longer function with the relogin process. Version-Release number of selected component (if applicable): 5.0.4 How reproducible: Easy Steps to Reproduce: 1. Login with Fedora SSO 2. Try to relogin using Fedora SSO Actual results: Fedora SSO refuses to connect Expected results: Fedora SSO is not available via the relogin process. Additional info: The point of the relogin process is to make it so users can reauthenticate without losing any content entered in to the current page. As we can't do that without using an iframe to process the SSO request we can no longer offer this to Fedora SSO users.
Odd. I am not aware of any changes in this area in the fedora SSO. When did it last work as you expect? Also adding abompard here in case he can think of any change in this area.
Yeah I don't think we've changed anything about that recently. Looking at ansible and ipsilon code, it looks like this option has been there since 2017 at least. Has it ever worked? I suppose we could set an exception for BZ.
We did test this, so it was working. I only use it when I'm testing changes to it so I don't know when it stopped working.
So do we want to remove it from the relogin or grant it an exception
Unfortunately Ipsilon does not have an allow list for iframes yet. It's not hard to add, but it'll need to go through the code-PR-review-release cycle.
Is there a ticket in another system we can link to?
There is, it's https://pagure.io/ipsilon/
I think this dropped off our radar... Aurelien: what was the status here? were we going to try and add allow list for iframes here? I think it would be nice to have this working...
There doesn't appear to be an ipsilon issue for this, so I will keep this open for now, but I won't disable it for now either. The only issue I could find upstream [1] concludes that the way to prevent XSS is to use 'deny', IMO the correct way to prevent XSS is to set 'sameorigin'. It does seem to make it possible to disable it per endpoint ... not sure that is actually desirable, as changing deny to sameorigin for endpoints would be better than just disabling the protection. 1: https://pagure.io/ipsilon/issue/15
This should let us configure the domains allowed to use (i)frames: https://pagure.io/ipsilon/pull-request/412 Using "sameorigin" would not work because the domains are differente (redhat.com for BZ, fedoraproject.org for Ipsilon). I'll try to get that patch in our prod instance in the next days, after some testing.
@aurelien any update on this? This is the last open bug for this product so it'd be nice to close it :)