Comments (12)
Yeah, it could be.
Let me try that way.
from flowcrypt-browser.
@sosnovsky For this one, how can we differentiate between GoogleAuthErr
and EnterpriseServerAuthErr
?
Are you considering sending different HTTP status codes from FES side (e.g., 401 for GoogleAuthErr
and another code for EnterpriseServerAuthErr
)?
Or will we use the same 401 status code but with a distinct data object, perhaps with a type like UNAUTHORIZED_ENTERPRISE_SERVER
or similar?
from flowcrypt-browser.
By the way, when a 401 error occurs, we currently trigger GoogleAuth.newAuthPopup (which also calls ConfiguredIdpOAuth.newAuthPopupForEnterpriseServerAuthenticationIfNeeded).
I think the current implementation doesn't disturb user too much, despite displaying two popups (Google and custom IDP) when a 401 error occurs?
What's your opinion?
from flowcrypt-browser.
@sosnovsky For this one, how can we differentiate between
GoogleAuthErr
andEnterpriseServerAuthErr
? Are you considering sending different HTTP status codes from FES side (e.g., 401 forGoogleAuthErr
and another code forEnterpriseServerAuthErr
)? Or will we use the same 401 status code but with a distinct data object, perhaps with a type likeUNAUTHORIZED_ENTERPRISE_SERVER
or similar?
We should differentiate them by current stage of authorization:
- if extension receives authorization error while trying to login with Google account, it should be
GoogleAuthErr
and showGoogleOAuth
popup - if user successfully signed in with Google and receives error when login with custom IdP - error type will be
EnterpriseServerAuthErr
and should showConfiguredIdpOauth
popup
By the way, when a 401 error occurs, we currently trigger GoogleAuth.newAuthPopup (which also calls ConfiguredIdpOAuth.newAuthPopupForEnterpriseServerAuthenticationIfNeeded). I think the current implementation doesn't disturb user too much, despite displaying two popups (Google and custom IDP) when a 401 error occurs?
Probably it's possible to store current stage of user authorization, and if user successfully signed in with Google, then we should call only ConfiguredIdpOAuth.newAuthPopupForEnterpriseServerAuthenticationIfNeeded
, without Google auth screen.
from flowcrypt-browser.
I think we might have a misunderstanding.
The custom IDP id_token
is used in FES API calls.
From what I understand about this issue, when FES attempts to validate the id_token
with the custom IDP and encounters an issue (such as unauthorized access or an invalid id_token
), we should display the custom IDP authentication popup instead of the Google authentication popup.
Please let me know if I got this wrong.
from flowcrypt-browser.
Yeah, sorry, looks like I incorrectly thought it relates to initial user authorization, but mentioned differentiation should be used for FES and key manager calls.
I started reviewing #5802 and noticed that you use custom token only for FES calls, but it should also be used for key manager calls (like getPrivateKeys). And then we'll need method for retrieving token for custom IdP similar to googleApiAuthHeader, which will also refresh expired access tokens, so refresh token for custom IdP should also be stored locally.
from flowcrypt-browser.
Yeah, I Agree
from flowcrypt-browser.
Let me try to clairfy.
Do you mean we need to refresh access_token including id_token when we get unauthorized error from EKM/FES? (You know we use ID_TOKEN for FES and EKM calls. not access_token)
And then we'll need method for retrieving token for custom IdP similar to googleApiAuthHeader, which will also refresh expired access tokens
Also could you answer my first question?
Are you considering sending different HTTP status codes from FES side (e.g., 401 for GoogleAuthErr and another code for EnterpriseServerAuthErr)?
Or will we use the same 401 status code but with a distinct data object, perhaps with a type like UNAUTHORIZED_ENTERPRISE_SERVER or similar?
from flowcrypt-browser.
Do you mean we need to refresh access_token including id_token when we get unauthorized error from EKM/FES? (You know we use ID_TOKEN for FES and EKM calls. not access_token)
We currently have googleAuthRefreshToken
method for refreshing user tokens, probably we can make it universal for both Google and custom IdP, so it'll generate refresh URL depending on IdP type. It saves locally access and id tokens, so we can store both of them for custom IdP too, while using only id token for Enterprise Server requests.
Are you considering sending different HTTP status codes from FES side (e.g., 401 for GoogleAuthErr and another code for EnterpriseServerAuthErr)?
Or will we use the same 401 status code but with a distinct data object, perhaps with a type like UNAUTHORIZED_ENTERPRISE_SERVER or similar?
I think it'll be the same 401 Unauthorized
error on backend, and then client (browser extension) will decide which authorization popup it should show (Google or custom IdP). So when extension receives 401 Unauthorized
from backend it should check if current user uses custom IdP - if yes then show custom IdP auth modal (as it's token is used for ES requests), if no custom IdP configured - show Google auth modal (like it works currently).
from flowcrypt-browser.
I see. Sounds good
from flowcrypt-browser.
@sosnovsky Is it really necessary to differentiate between the GoogleAuthPopup and the Custom IDP popup? When an EnterpriseServerAuthError
occurs (such as when no id_token
or refresh_token
is saved or if the tokens are invalid), it seems acceptable to show both auth popups (Google OAuth and Custom IDP as it is now) to refresh both tokens.
I'm asking because differentiating between these two popups would require significant changes to the current notificationShowAuthPopupNeeded
infrastructure.
Have to check if GoogleAuthError
or EnterpriseServerAuthErr
in every catch statements and add another method to show EnterpriseAuthPopup
from flowcrypt-browser.
I think it should be simpler than checking error type for each ApiErr.isAuthErr
- custom IdP error can occur only when sending requests to Enterprise Server (like getting reply token for password-protected messages, fetching or updating private keys), probably all of them are in key-manager.ts
and external-service.ts
.
For example, requests for fetching inbox messages or searching recipients won't have custom IdP error, as they communicate directly with Google IdP.
What do you think, can we implement it this way?
from flowcrypt-browser.
Related Issues (20)
- refactor content scripts to make it easier to implement Thunderbird support HOT 3
- Update web-ext to v8 HOT 1
- Error when trying to send exception from content script
- Attachments are not decrypted in Gmail offline mode HOT 8
- acctEmail is not included when redirecting user to compatibility checker page
- Message loading is stuck in Firefox HOT 9
- Firefox manifest.json includes background.service_worker as a manifest version 2
- Add test for the FlowCrypt for Thunderbird implementation HOT 3
- MIME type parsing for Thunderbird extension build
- Use appropriate Namespace/Typings for Firefox build
- [URGENT] FlowCrypt browser extension signin is blocked HOT 18
- Reduce items on GlobalStore.get(['account_emails']) when users perform reset (logout)
- if special JWT is stored in local store, it should be used for Enterprise Server authentication instead of Google JWT
- missing key management features? HOT 1
- Unstable tests in Semaphoreci HOT 1
- Live tests fail after https://github.com/FlowCrypt/flowcrypt-browser/pull/5795
- Sending feedback to /shared-tenant-fes/api/v1/account/feedback should be encrypted by a reciever's public key HOT 4
- [Feature Suggestion] Ability to generate keys within the extension HOT 1
- [Feature Suggestion] Ability to manage any backups from Gmail HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from flowcrypt-browser.