Element-web: SSO in desktop app depends on Electron bug

[dbkr]

SSO relies on redirecting the user to the SSO URL. This is problematic in the desktop app as we normally intercept will-navigate to open links in the browser, although it happens that at the moment, https://github.com/electron/electron/issues/8841 breaks will-navigate which means SSO opens in riot itself and therefore works...

Reporting to remember that it will break if that Electron bug gets fixed.

[ineiti]

Another +1 for fixing that bug is that it breaks our implementation of the CAS login, which relies on having access to the storageDB of the user's browser. The idea behind is that we want to offer a passwordless login, so the user data is kept in the browser of the user.

Unfortunately, the browser used in the electron app and the browser in the mobile app are different from the browser the user is using. So even the user has its data stored in the storageDB of his browser, the login-page of both the mobile and the desktop app cannot access this data.

So for our authentication scheme, SSO only works in the web-app, but neither in the mobile, nor in the desktop app.

[t3chguy]

Riot electron seems to open all links using openExternal now so maybe this is fixed

[ineiti]

Just tried Version 1.3.2 (1.3.2) both on MacOSX desktop and mobile phone, but this doesn't work. What is the version that should work?

[t3chguy]

Electron 8.0.2 fixes this issue and thus breaks our SSO.

[jryans]

Electron 8.0.2 has fixed the will-navigate issue, so we either need to find a fix or downgrade Electron before release.

[jryans]

We plan to handle this by:

• adding a riot:// system protocol handler
• SSO auth would open a browser tab
• after auth, the browser will callback to a riot:// URL

[ineiti]

Would that mean that our SSO, which depends on data stored in the user browser, would finally work?

[t3chguy]

Yup, thats part of the reason why it was picked, other part is so you never have to enter third party credentials into an app which shouldn't ever see them, even if it doesn't actually spy on them

[ineiti]

Cool! Looking forward to that - so we'll be able to use https://www.c4dt.org/article/cas-for-omniledger/ also on our mobile devices ;)

[t3chguy]

Thought I'd share some progress

[jryans]

Removed release-blocker as we've added a workaround for the moment in https://github.com/vector-im/riot-web/pull/12585 for the upcoming release.

[t3chguy]